CVE-2026-101949 is a NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. An unauthenticated remote BGP neighbor can trigger a denial of service by sending a VPN-flowspec BGP update that is readvertised when BMP post-policy RIB-out monitoring is enabled. This vulnerability affects multiple versions of Junos OS and Junos OS Evolved as specified. The CVSS 3.1 base score is 7.5, indicating high severity due to the potential for denial of service without requiring authentication.
CVE-2026-92160 is an integer overflow vulnerability in the nasa fprime framework prior to version 4.3.0. The flaw occurs in the Svc::FileDownlink SendPartial function where a wrapping sum bypasses file-range validation, causing the process to abort or reset and resulting in denial of service. This issue is fixed in version 4.3.0.
CVE-2026-101964 is a reachable assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. An adjacent attacker can cause the rpd process to crash by sending a specially crafted Label Distribution Protocol (LDP) packet over an established LDP session. This vulnerability affects multiple versions of Junos OS and Junos OS Evolved as specified. The vulnerability has a CVSS v3.1 score of 6.5, indicating a medium severity impact primarily due to availability disruption.
CVE-2026-101963 is a high-severity vulnerability in Juniper Networks Junos OS and Junos EVO. It involves an incorrect calculation in the routing protocol daemon (rpd) that can be triggered remotely by a BGP EVPN neighbor when SRv6 EVPN multihoming is configured. Exploitation causes the rpd process to crash, resulting in denial of service. The vulnerability affects multiple specific versions of Junos OS and Junos EVO as detailed in the affected versions list. No known exploits are reported in the wild. The CVSS score is 7.5, indicating a high impact on availability but no confidentiality or integrity impact.
CVE-2026-101962 is a high-severity vulnerability in Juniper Networks Junos OS and Junos OS Evolved affecting the routing protocol daemon (rpd). It involves improper handling of length parameter inconsistency in processing BGP EVPN multicast updates, which can cause the rpd process to crash. This vulnerability does not impact confidentiality or integrity but results in denial of service due to process crash. Multiple versions of Junos OS and Junos OS Evolved are affected across various release streams. No known exploits in the wild have been reported. Patch status is not confirmed in the provided data; users should consult Juniper's official advisories for remediation guidance.
F Prime (F´) is a framework for spaceflight and embedded software applications. Versions prior to 4.2.0 have a vulnerability in the deserialization of file packets where an assertion can be triggered by an invalid file-packet type byte. This causes the application process to abort or reset, resulting in a denial of service. The issue is fixed in version 4.2.0.
CVE-2026-101961 is a NULL Pointer Dereference vulnerability in the routing-policy nexthop-ECMP matcher of Juniper Networks Junos OS and Junos OS Evolved. It allows a configured eBGP peer to cause a denial of service of the routing daemon by sending a specific BGP packet when a nexthop-ecmp qualifier is attached to a BGP import policy. This vulnerability has a high severity score of 7.5 and impacts multiple versions of Junos OS and Junos OS Evolved.
CVE-2026-101959 is a vulnerability in Juniper Networks Junos OS and Junos OS Evolved affecting the routing protocol daemon (rpd). It involves a function call with an incorrect variable or reference as an argument, which can be triggered by an unauthenticated adjacent attacker using a specially crafted LSP-ping message. Successful exploitation causes the rpd process to crash, resulting in a denial of service. The vulnerability has a CVSS 3.1 score of 6.5 (medium severity).
CVE-2026-92150 is a reachable assertion vulnerability in the nasa fprime framework prior to version 4.2.0. The issue arises in the Svc::GenericHub fromBufferDriver_handler deserialization process, where externally influenced deserialization status and type validation use FW_ASSERT. This allows a command payload size subtraction to underflow. An unauthenticated inter-processor hub peer can send malformed hub traffic such as truncated buffers, invalid HubType, or header-only command-dispatch payloads, causing the process to abort or reset and resulting in denial of service. The vulnerability is fixed in version 4.2.0.
CVE-2026-101983 is a critical stack-based buffer overflow vulnerability in the httpd process of Juniper Networks Junos OS and Junos OS Evolved. It allows an unauthenticated network attacker to remotely execute code and cause denial of service when a J-Web virtual-domain is configured. The vulnerability affects multiple specific versions of Junos OS and Junos OS Evolved. The CVSS score is 9.8, indicating a high severity with network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality, integrity, and availability. No known exploits in the wild have been reported yet.
CVE-2026-92154 is an integer overflow vulnerability in the nasa fprime framework prior to version 4.2.0. The vulnerability occurs in the Svc::FileUplink component's handleDataPacket function, where offset and size validation uses wrapping 32-bit unsigned arithmetic. This allows an attacker to supply a byteOffset and dataSize whose sum wraps around, causing data to be written beyond the declared upload size. This can lead to file integrity loss and potentially large sparse-file growth or resource exhaustion. The issue is fixed in version 4.2.0.
CVE-2026-101982 is a critical stack-based buffer overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. It allows a configured BGP/EVPN peer to cause root code execution on Junos OS or crash the rpd process on Junos OS Evolved by sending protocol-valid route advertisements for an EVPN-VPWS service. The vulnerability affects multiple versions of Junos OS and Junos OS Evolved prior to specific patch releases. The CVSS score is 9.8, indicating a high severity with network attack vector, no privileges required, and impacts on confidentiality, integrity, and availability. No known exploits in the wild have been reported. Juniper Networks has not provided explicit patch links in the input data, so patch status should be verified with the vendor.
CVE-2026-101981 is a stack-based buffer overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. It allows an unauthenticated adjacent LDP peer to cause a crash or execute arbitrary code by sending a malformed LDP Label Mapping message. The vulnerability affects multiple versions of Junos OS and Junos OS Evolved as specified. The CVSS v3.1 base score is 8.8, indicating high severity with impacts on confidentiality, integrity, and availability.
CVE-2026-101979 is a stack-based buffer overflow vulnerability in the authd component of Juniper Networks Junos OS and Junos OS Evolved. It allows a network attacker with SNMP read access to execute code with root privileges or cause a denial of service via a crafted SNMP packet, when SNMP and AAA are enabled. The vulnerability affects multiple versions of Junos OS and Junos OS Evolved prior to specific patched releases. The CVSS score is 8.8, indicating high severity.
CVE-2026-101976 is an out-of-bounds write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. It allows an eBGP peer that has not negotiated four-octet-AS capability to send a specially crafted BGP update, causing a denial-of-service (DoS) condition. The vulnerability affects multiple versions of Junos OS and Junos OS Evolved prior to specific patched releases. The CVSS v3.1 score is 7.5, indicating high severity due to the potential for service disruption without requiring privileges or user interaction.
CVE-2026-101975 is a reachable assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. It allows an adjacent OSPF peer to cause a denial of service via OSPF traffic when OSPF Source Packet Routing best-route Prefix-SID installation is configured. The vulnerability has a CVSS 3.1 score of 6.5, indicating medium severity. Multiple versions of Junos OS and Junos OS Evolved are affected, spanning several release series. No known exploits are reported in the wild.
CVE-2026-101972 is an integer overflow or wraparound vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. An unauthenticated adjacent attacker can exploit this flaw by sending specific OSPFv2 packets on an OSPF-enabled interface to cause a denial of service. The vulnerability affects multiple versions of Junos OS and Junos OS Evolved as specified. The CVSS 3.1 base score is 6.5, indicating a medium severity impact focused on availability disruption.
CVE-2026-92158 is an integer overflow vulnerability in the NASA fprime framework before version 4.2.0. It occurs in the Svc::FpySequencer STORE directive stack write validation, where an attacker-controlled offset and size are added before a memcpy operation. This can cause an integer wraparound, allowing memcpy to write outside the intended stack memory. The vulnerability can lead to memory corruption, denial of service, and potentially code execution. The issue is fixed in version 4.2.0.
CVE-2026-102077 is a high-severity vulnerability in Juniper Networks Junos OS on MX Series with SPC3 line-cards. It involves improper handling of malformed IPv6 packets when source NAT is configured, causing the device to allocate NAT resources unnecessarily. This leads to session or resource exhaustion, resulting in a denial-of-service (DoS) condition that requires a device reboot to recover.
CVE-2026-92159 is a medium severity vulnerability in NASA's F Prime (fprime) framework prior to version 4.3.0. The issue involves improper handling of length parameters in the Svc::TlmPacketizer component, where a fixed-slot copy operation copies more data than the allocated channel slot size, causing adjacent channel fields to be overwritten and resulting in corrupted telemetry packets. This flaw is fixed in version 4.3.0.