CVE-2026-101950
CriticalCVSS 9.8Summary
A Heap-based Buffer Overflow in the SVR component of Junos OS on SRX Series allows an unauthenticated network attacker to cause denial of service and potentially compromise confidentiality and integrity via malformed IPv4 packets.
Risk Assessment
The attack can disrupt SRX device operation and potentially lead to data leakage or modification.
Recommendation
Install patches from Juniper Networks and restrict access to interfaces configured for Secure Vector Routing.
Other vulnerabilities in Junos OS
See all- CVE-2026-33798High
A Stack-based Buffer Overflow vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series. An L2-adjacent attacker can execute arbitrary code as root via high-availability fabric traffic.
- CVE-2026-33795High
A Numeric Truncation Error vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved. An unauthenticated network-based attacker can cause a denial of service via a BGP Prefix-SID route advertisement that is subsequently re-advertised.
- CVE-2026-103994High
A Heap-based Buffer Overflow vulnerability in the VXLAN Gateway Daemon (vgd) of Juniper Networks Junos OS. A malicious or compromised SDN-controller can cause a complete outage of the OVSDB control plane and possibly remote code execution.
- CVE-2026-103993Medium
An out-of-bounds write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker sending a specific set of BGP communities to cause a denial of service (DoS) as rpd crashes when the graceful-shutdown sender community is added during advertisement.
- CVE-2026-102185High
A Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. A remote network attacker can cause a denial of service via EVPN multihoming with preference-based designated-forwarder election.
- CVE-2026-102184High
An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos Evolved platforms. A configured EVPN signaling peer can cause an rpd crash via a malformed SRv6 structure carried in an EVPN route update, resulting in a denial of service affecting routing adjacencies.
- CVE-2026-102183High
An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. A configured BGP EVPN peer can cause an rpd crash via a specifically malformed NLRI.
- CVE-2026-102180High
A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP peering session to cause a denial of service by sending a crafted BGP route attribute, which is processed while a BGP RIB streaming telemetry subscription is active.
- CVE-2026-102179High
An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP EVPN peer to cause a denial of service via BGP EVPN route processing when the l2vpn-evpn RIB telemetry sensor is subscribed.
- CVE-2026-102177High
An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service when IS-IS link protection and backup-selection are configured.
Original NVD description (English source)
A Heap-based Buffer Overflow vulnerability in the SVR component of Juniper Networks Junos OS on SRX Series allows an unauthenticated network attacker to cause a denial of service and potentially compromise confidentiality and integrity via malformed IPv4 packets reaching an interface configured for Secure Vector Routing.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS