CVE-2026-102180

A Stack-based Buffer Overflow vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series. An L2-adjacent attacker can execute arbitrary code as root via high-availability fabric traffic.

A Numeric Truncation Error vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved. An unauthenticated network-based attacker can cause a denial of service via a BGP Prefix-SID route advertisement that is subsequently re-advertised.

A Heap-based Buffer Overflow vulnerability in the VXLAN Gateway Daemon (vgd) of Juniper Networks Junos OS. A malicious or compromised SDN-controller can cause a complete outage of the OVSDB control plane and possibly remote code execution.

A Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. A remote network attacker can cause a denial of service via EVPN multihoming with preference-based designated-forwarder election.

An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos Evolved platforms. A configured EVPN signaling peer can cause an rpd crash via a malformed SRv6 structure carried in an EVPN route update, resulting in a denial of service affecting routing adjacencies.

An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. A configured BGP EVPN peer can cause an rpd crash via a specifically malformed NLRI.

An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP EVPN peer to cause a denial of service via BGP EVPN route processing when the l2vpn-evpn RIB telemetry sensor is subscribed.

An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service when IS-IS link protection and backup-selection are configured.

A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in the SDK service process of Juniper Networks Junos OS allows an unauthenticated network attacker to cause a denial of service or compromise the Routing Engine by sending specific packets when the SDK service and a JDAF routing instance are enabled.

A Stack-based Buffer Overflow vulnerability in the iked IKE key-management daemon of Juniper Networks Junos OS on the SRX Series allows an authenticated remote-access VPN client to execute code with root privileges or cause denial of service via the remote-access VPN authentication and JIMS identity-publishing path.