CVE-2026-102025: CWE-762 Mismatched Memory Management Routines in Juniper Networks Junos OS

This vulnerability (CVE-2026-102025) arises from mismatched memory management routines in the rpd process of Juniper Networks Junos OS and Junos OS Evolved. An authenticated attacker can exploit this via BGP route updates involving extended next-hop tunneling and SRv6 service processing to cause a denial of service condition. The issue affects multiple versions of Junos OS and Junos OS Evolved prior to certain patch releases, as detailed in the affectedVersions list. The CVSS 3.1 base score is 7.5, indicating high severity, with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability (denial of service).

An authenticated network-based attacker can cause a denial of service in the routing protocol daemon (rpd) process by sending crafted BGP route updates when extended next-hop tunneling and SRv6 service processing are used. This results in service disruption but does not impact confidentiality or integrity. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch links are provided, users should monitor Juniper Networks advisories for updates. Until a fix is available, consider disabling extended next-hop tunneling and SRv6 service processing if feasible to reduce exposure.