CVE-2026-92156 is a vulnerability in NASA's F Prime framework prior to version 4.3.0. It involves incorrect calculation of buffer size in the EventManager's log queue internal interface handler. The issue arises because EventManager accepts log buffers up to the maximum size but does not properly account for metadata overhead, leading to serialization failures and assertion triggers. This can cause a denial of service by aborting or resetting the process when a legal bridged event payload exceeds the remaining log-argument budget. The vulnerability is fixed in version 4.3.0.
CVE-2026-92157 is an integer overflow vulnerability in the nasa fprime framework prior to version 4.3.0. The flaw occurs in the Svc::FileDownlink SendPartial range validation, where unchecked arithmetic on startOffset and length can cause a wraparound, leading to inconsistent offset values. This triggers an assertion failure under standard F Prime handling, causing the process to abort or reset and resulting in a denial of service. The issue is resolved in version 4.3.0.
CVE-2026-92152 is a critical vulnerability in NASA's F Prime (fprime) framework versions 4.1.0 up to but not including 4.2.0. It involves improper validation of an array index in the Svc::GenericHub output-port dispatch, where a deserialized port field is used without explicit range checks. This flaw can lead to out-of-bounds array access, resulting in heap corruption and potentially enabling remote code execution. The vulnerability is fixed in version 4.2.0.
CVE-2026-33798 is a high-severity stack-based buffer overflow vulnerability in the srxpfe component of Juniper Networks Junos OS and Junos OS Evolved on SRX Series devices. It allows an L2-adjacent attacker to execute arbitrary code with root privileges via high-availability fabric traffic. The vulnerability affects multiple versions of Junos OS and Junos OS Evolved as specified. No known exploits are reported in the wild. The CVSS v3.1 base score is 8.8, indicating a high impact on confidentiality, integrity, and availability.
CVE-2026-33796 is a critical stack-based buffer overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. It allows a configured external BGP neighbor to execute arbitrary commands with root privileges via BMP route monitoring. The vulnerability affects multiple versions of Junos OS and Junos OS Evolved prior to specific fixed releases. The CVSS v3.1 base score is 9.8, indicating a critical severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. There are no known exploits in the wild at this time. Juniper Networks has not provided explicit patch links in the input data, so patch status should be verified with the vendor advisory.
CVE-2026-33795 is a numeric truncation error vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved. It allows an unauthenticated network-based attacker to cause a denial of service by sending a BGP Prefix-SID route advertisement that is then re-advertised. The vulnerability affects multiple versions starting from 20.4R1 and later, including various specific release ranges for both Junos OS and Junos OS Evolved.
CVE-2026-33792 is a critical stack-based buffer overflow vulnerability in the srxpfe process of Juniper Networks Junos OS on SRX Series devices. It allows an unauthenticated network attacker to execute code as root or cause a denial of service by sending a crafted packet on a configured GRE tunnel. The vulnerability affects multiple Junos OS versions prior to specific patch releases. The CVSS score is 9.8, indicating a high severity with network attack vector, no privileges or user interaction required, and impacts confidentiality, integrity, and availability.
CVE-2026-33789 is a critical stack-based buffer overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. It allows an unauthenticated BGP peer to cause denial of service and potentially execute root-level commands via crafted BGP route updates when the BGP Monitoring Protocol (BMP) is enabled. The vulnerability affects multiple versions of Junos OS and Junos OS Evolved prior to specific patch releases. The CVSS v3.1 score is 9.8, indicating a critical severity level.
CVE-2026-102185 is an infinite loop vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. This flaw occurs during EVPN multihoming with preference-based designated-forwarder election and can be triggered remotely by an attacker. Exploitation leads to a denial of service condition by causing the affected process to hang indefinitely. The vulnerability has a high severity rating with a CVSS score of 7.5. Multiple versions of Junos OS and Junos OS Evolved are affected, spanning several release trains and variants. No known exploits are reported in the wild. No explicit patch or remediation information is provided in the input data.
CVE-2026-102184 is a high-severity vulnerability in Juniper Networks Junos OS and Junos Evolved platforms. It involves improper validation of specified quantity in input within the routing protocol daemon (rpd). A configured EVPN signaling peer can send a malformed SRv6 structure in an EVPN route update, causing the rpd process to crash. This results in a denial of service affecting routing adjacencies. The vulnerability affects multiple specific versions of Junos OS and Junos Evolved as detailed in the affectedVersions field.
CVE-2026-102183 is a high-severity vulnerability in Juniper Networks Junos OS and Junos OS Evolved affecting the routing protocol daemon (rpd). It involves improper validation of specified quantity in input, allowing a configured BGP EVPN peer to cause an rpd crash via a malformed NLRI. This results in a denial of service condition. The vulnerability affects multiple versions of Junos OS and Junos OS Evolved prior to specific fixed releases. No known exploits are reported in the wild at this time.
CVE-2026-102182 is a critical stack-based buffer overflow vulnerability in the kmd component of Juniper Networks Junos OS on MX Series devices. It allows an unauthenticated network attacker to execute code as root by sending specially crafted IKE certificate-based packets. The vulnerability requires IKE to be enabled with an RSA-signature IKE policy to be exploitable. Multiple versions of Junos OS on MX Series are affected, specifically versions before certain fixed releases in the 21.x through 26.x release trains.
CVE-2026-102180 is a stack-based buffer overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. It allows an attacker with access to a configured BGP peering session to cause a denial of service by sending a specially crafted BGP route attribute during an active BGP RIB streaming telemetry subscription. This vulnerability affects multiple versions of Junos OS and Junos OS Evolved starting from 22.1R1 and later, up to certain patched releases. The vulnerability has a high severity rating with a CVSS score of 7.5.
CVE-2026-102179 is an out-of-bounds write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. It affects systems with a configured BGP EVPN peer and the l2vpn-evpn RIB telemetry sensor subscribed. Exploitation can cause the rpd daemon to crash, resulting in denial of service and interruption of routing protocols until recovery.
CVE-2026-102178 is a critical stack-based buffer overflow vulnerability in the BGP routing daemon of Juniper Networks Junos OS and Junos OS Evolved. It allows a configured BGP flowspec peer to cause routing-engine compromise or routing-daemon denial of service via flowspec route re-advertisement when BGP update-threading is enabled. The vulnerability affects multiple versions of Junos OS and Junos OS Evolved prior to specific patch releases.
CVE-2026-102177 is an out-of-bounds write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. It allows an adjacent unauthenticated attacker to cause a denial of service when IS-IS link protection and backup-selection are configured. The vulnerability affects multiple versions of Junos OS and Junos OS Evolved prior to specific patch releases. The CVSS score is 7.6, indicating high severity.
CVE-2026-102176 is a high-severity buffer overflow vulnerability in the SDK service process of Juniper Networks Junos OS. It allows an unauthenticated network attacker to cause denial of service or potentially compromise the Routing Engine by sending crafted packets when the SDK service and a JDAF routing instance are enabled. The vulnerability affects multiple Junos OS versions prior to specific patch releases.
CVE-2026-102175 is a critical heap-based buffer overflow vulnerability in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved. It allows a remote unauthenticated attacker who can control or intercept the configured SDX/SRC server connection to execute code as root or cause denial of service by sending a crafted frame over the service-deployment TCP connection. The vulnerability affects multiple versions of Junos OS and Junos OS Evolved as specified. No known exploits in the wild have been reported. The CVSS v3.1 score is 9.8, indicating a critical severity level.
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP stdlib (erl_tar module), hexpm hex_core (hex_erl_tar module), hexpm hex (mix_hex_erl_tar module) and erlang rebar3 (r3_hex_erl_tar module) allows an attacker who supplies a tar archive to cause a denial of service via a crafted GNU sparse member.
When erl_tar:extract/1,2 writes a member to disk, erl_tar:stream_to_file_loop/3 reads it in chunks of 65536 bytes by default. For a GNU sparse member whose sparse map ends before its real size, erl_tar:do_sparse_read/3 matches its trailing-hole clause before its zero-length clause. After the chunk is used up, the trailing-hole clause reads zero bytes, does not advance the position, and recurses forever. A 2048-byte archive keeps the extracting process and one scheduler busy until the process is killed. The {max_size, N} option prevents this only when N is below the real size of the member. Extraction with the memory option is not affected.
hex_core ships its own copy of erl_tar as hex_erl_tar, and Hex and rebar3 ship hex_core with prefixed module names (mix_hex_erl_tar and r3_hex_erl_tar). These copies contain the same code and do not call stdlib's erl_tar, so they are affected on any OTP version. OTP 28 is not affected, but an application running on OTP 28 is affected if it extracts archives through an affected version of hex_core, Hex or rebar3.
This issue affects OTP from OTP 29.0 before OTP 29.1.2, corresponding to rebar3 from 3.27.1 before 3.28.0, and stdlib from 8.0 before 8.1.1, and hex from 2.4.2 before 2.5.3; hex_core: from 0.14.0 before 0.20.1.
CVE-2026-102174 is a stack-based buffer overflow vulnerability in the iked IKE key-management daemon of Juniper Networks Junos OS on the SRX Series. It allows an authenticated remote-access VPN client to execute code with root privileges or cause a denial of service. The vulnerability affects multiple Junos OS versions prior to specific patch releases. The CVSS score is 8.8, indicating high severity.