CVE-2026-102185: CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop') in Juniper Networks Junos OS
Description
CVE-2026-102185 is a high-severity vulnerability in Juniper Networks Junos OS and Junos OS Evolved affecting the routing protocol daemon (rpd). It involves an infinite loop caused by an unreachable exit condition triggered via EVPN multihoming with preference-based designated-forwarder election. This can lead to a denial of service (DoS) condition. The vulnerability affects multiple versions of Junos OS and Junos OS Evolved prior to specific patch releases. No known exploits are reported in the wild. The CVSS score is 7.5, indicating a significant impact on availability without affecting confidentiality or integrity.
CVSS v3.1
Score 7.5high
Affected software
Juniper Networks
Junos OS
Juniper Networks
Junos OS Evolved
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CVE-2026-102185) in Juniper Networks Junos OS and Junos OS Evolved is due to a loop with an unreachable exit condition in the routing protocol daemon (rpd). The infinite loop can be triggered remotely by an attacker leveraging EVPN multihoming with preference-based designated-forwarder election, causing the affected process to hang and resulting in denial of service. The issue affects multiple versions across several Junos OS and Junos OS Evolved releases, as explicitly enumerated. The CVSS v3.1 score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, no confidentiality or integrity impact, but high impact on availability.
Potential Impact
A remote network attacker can cause a denial of service by triggering an infinite loop in the routing protocol daemon (rpd) via EVPN multihoming with preference-based designated-forwarder election. This results in the affected Junos OS or Junos OS Evolved device becoming unresponsive or degraded in routing functionality, impacting network availability. There is no impact on confidentiality or integrity reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or workaround information is provided in the available data. Users should monitor Juniper Networks advisories for updates and apply patches once available. Until then, consider limiting exposure of affected services to untrusted networks if possible.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- juniper
- Date Reserved
- 2026-09-28T18:17:13.470Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6acfb9f02cdf04f6569934a4
Added to database: 10/14/2026, 17:20:48 UTC
Last enriched: 10/14/2026, 17:33:42 UTC
Last updated: 10/14/2026, 17:36:07 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.