Juniper Junos OS Stack Buffer Overflow in BGP Lets Peers Crash Daemons or Execute Code

Security researchers have identified a severe vulnerability in Juniper Networks Junos OS that permits remote code execution through manipulated Border Gateway Protocol messages. The National Vulnerability Database lists CVE-2026-101990 as a critical issue with a base score of 9.8. This flaw resides within the routing protocol daemon, known as rpd, which handles core network traffic decisions.

The defect is a stack-based buffer overflow triggered when the system processes specific flow-spec updates. If these updates are selected for re-advertisement to other peers, the rpd process crashes. On standard Junos OS installations, this crash can be leveraged to execute arbitrary code remotely. Junos OS Evolved systems suffer the same crash but do not permit code execution through this specific vector.

Scope of exposure

The vulnerability impacts a wide range of Juniper software versions. Affected systems include Junos OS releases before 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, and 24.4R2-S5. Junos OS Evolved users are also at risk if they run versions before 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, or 24.4R2-S5-EVO.

Organisations must check their inventory for these specific version strings. Any device running an earlier release is potentially vulnerable to the described crash or code execution scenarios. The scope covers both mainline and evolved operating system branches, meaning network operators using either platform need to verify their current patch levels immediately.

What happens next

No patch or fix has been confirmed yet in the source material. Administrators should monitor vendor channels for official updates regarding these specific version cutoffs. Until a remediation is released, the primary mitigation relies on network architecture controls. Teams should restrict BGP peering to trusted sources and validate flow-spec updates at the edge of the network to prevent malicious data from reaching the rpd process.

Why this attack works

Buffer overflows occur when a program writes more data to a memory buffer than it can hold. In this scenario, the routing daemon fails to validate the size of incoming flow-spec updates before processing them. This lack of boundary checking allows an attacker to overwrite adjacent memory locations. For intrusion teams, this serves as an initial access or privilege escalation vector. It demonstrates why strict input validation is crucial in network protocol implementations, as untrusted data from peers can directly compromise the system’s integrity and control flow.

What to do and how to stay safe: Juniper Networks

• Verify the exact version of Junos OS or Junos OS Evolved running on your routing infrastructure.
• Compare your current version against the list of affected releases provided by the National Vulnerability Database.
• Implement strict filtering for BGP flow-spec updates from external peers to reduce exposure.
• Monitor routing daemon logs for unexpected crashes or restarts that may indicate exploitation attempts.

Step-by-step guide: Patch Management Policy: How to Automate Fixes Without Breaking Systems

General security guidance from the Payload Report newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Does this vulnerability affect all versions of Juniper Junos OS?

No, it only affects versions prior to the specific maintenance releases listed in the NVD record, such as 24.4R2-S5.

Can Junos OS Evolved users achieve remote code execution through this flaw?

No, the source material states that while Junos OS Evolved suffers rpd crashes, remote code execution is limited to standard Junos OS.

What type of access does an attacker need to exploit this vulnerability?

An attacker needs to be a remote configured BGP peer, allowing them to send malicious flow-spec updates to the vulnerable device.