CVE-2026-102027: CWE-131 Incorrect Calculation of Buffer Size in Juniper Networks Junos OS

This vulnerability (CVE-2026-102027) arises from an incorrect buffer size calculation in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. When multipath features are enabled, a configured eBGP neighbor can send specially crafted BGP labeled-unicast UPDATE messages that trigger a crash of the rpd process. The flaw is classified under CWE-131 (Incorrect Calculation of Buffer Size). The issue affects multiple version ranges of Junos OS and Junos OS Evolved, including both standard and EVO variants, with specific version intervals identified as vulnerable. The CVSS v3.1 base score is 7.5, indicating high severity, with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability (denial of service).

Successful exploitation results in a denial of service condition by crashing the routing protocol daemon (rpd), potentially disrupting routing functions on affected devices. There is no impact on confidentiality or integrity reported. The vulnerability requires a configured eBGP neighbor to send malicious BGP labeled-unicast UPDATEs with multipath features enabled.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the input data. Until a patch is available, consider disabling the affected multipath features or restricting eBGP neighbor configurations to trusted entities to reduce exposure.