CVE-2026-102087: CWE-184 Incomplete Blacklist in Juniper Networks Junos OS
Description
An Incomplete List of Disallowed Inputs vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS). When in a BGP traffic engineering scenario a specific, valid, optional, non-transitive BGP update is received over an established BGP session, RPD crashes and automatically restarts, which leads to traffic impact until routing has reconverged. This issue affects: Junos OS: * All versions before 23.2R2-S6; * 23.4 versions before 23.4R2-S7; * 24.2 versions before 24.2R2-S4; * 24.4 versions before 24.4R2-S4; * 25.2 versions before 25.2R1-S2, 25.2R2; Junos OS Evolved: * All versions before 23.2R2-S6-EVO; * 23.4 versions before 23.4R2-S8.11-EVO; * 24.2 versions before 24.2R2-S4-EVO; * 24.4 versions before 24.4R2-S5-EVO; * 25.2 versions before 25.2R1-S2-EVO, 25.2R2-EVO;
CVSS v3.1
Score 6.5medium
Affected software
Juniper Networks
Junos OS
Juniper Networks
Junos OS Evolved
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CVE-2026-102087) in Juniper Networks Junos OS and Junos OS Evolved arises from an incomplete blacklist of disallowed inputs in the routing protocol daemon (rpd). When operating in a BGP traffic engineering context, receipt of a particular valid, optional, non-transitive BGP update over an established BGP session causes the rpd process to crash and restart. This leads to a temporary Denial-of-Service condition impacting network traffic until routing reconvergence completes. The vulnerability affects multiple versions of Junos OS and Junos OS Evolved prior to the following fixed releases: 23.2R2-S6, 23.4R2-S7, 24.2R2-S4, 24.4R2-S4, and 25.2R1-S2/25.2R2 for Junos OS; and 23.2R2-S6-EVO, 23.4R2-S8.11-EVO, 24.2R2-S4-EVO, 24.4R2-S5-EVO, and 25.2R1-S2-EVO/25.2R2-EVO for Junos OS Evolved.
Potential Impact
An unauthenticated, adjacent attacker can cause the routing protocol daemon (rpd) to crash and restart by sending a specific BGP update, resulting in a Denial-of-Service condition. This disrupts network traffic until routing reconverges, causing temporary network outages or degraded performance. There is no impact on confidentiality or integrity reported.
Mitigation Recommendations
Fixes are available in Juniper Networks Junos OS and Junos OS Evolved starting from versions 23.2R2-S6, 23.4R2-S7, 24.2R2-S4, 24.4R2-S4, and 25.2R1-S2/25.2R2 for Junos OS; and 23.2R2-S6-EVO, 23.4R2-S8.11-EVO, 24.2R2-S4-EVO, 24.4R2-S5-EVO, and 25.2R1-S2-EVO/25.2R2-EVO for Junos OS Evolved. Users should upgrade to these fixed versions to remediate the vulnerability. Patch status is confirmed by the vendor advisory. No additional mitigations are specified.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- juniper
- Date Reserved
- 2026-09-28T17:37:38.548Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6acfaf342cdf04f65694d395
Added to database: 10/14/2026, 16:35:00 UTC
Last enriched: 10/14/2026, 16:49:08 UTC
Last updated: 10/14/2026, 20:49:11 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.