CVE-2026-101991: CWE-130 Improper Handling of Length Parameter Inconsistency in Juniper Networks Junos OS

This vulnerability (CVE-2026-101991) arises from improper handling of length parameter inconsistencies in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. Specifically, a configured BGP-LS peer can trigger heap data disclosure by sending a malformed UPDATE message over a session where the traffic-engineering address family is enabled. The issue is categorized under CWE-130 (Improper Handling of Length Parameter Inconsistency). The CVSS v3.1 base score is 3.1, indicating low severity, with attack vector as adjacent network, high attack complexity, no privileges required, no user interaction, and limited confidentiality impact. Multiple affected version ranges are identified across different Junos OS and Junos OS Evolved releases.

The impact of this vulnerability is limited to potential heap data disclosure, which could expose sensitive information from the affected device's memory. There is no indication of integrity or availability impact. Exploitation requires a configured BGP-LS peer and sending a malformed UPDATE message over a session with the traffic-engineering address family enabled. The attack complexity is high, and no known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround information is provided, users should monitor Juniper Networks advisories for updates. Restricting or monitoring BGP-LS peer configurations and traffic-engineering address family usage may reduce exposure until a fix is available.