Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Juniper Networks | Junos OS | unaffected |
|
|||||||||||||||||||||||||||||||||
| Juniper Networks | Junos OS Evolved | unaffected |
|
No data.
No data.
No data available yet.
Vendor Solution
The following software releases have been updated to resolve this specific issue: Junos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1, and all subsequent releases. Junos OS Evolved: 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO, and all subsequent releases. Note: For Junos OS releases 23.2, 23.4, and 24.2, and Junos OS Evolved releases 23.2-EVO, 23.4-EVO, and 24.2-EVO, specific respins have been referenced. Previously published versions of these releases have been rebuilt to resolve the security vulnerabilities identified in this advisory.
Vendor Workaround
If not required EVPN multicast updates can be filtered with an import policy on the resp. BGP peers: [ policy-options policy-statement EVPN-NO-MCAST term reject from family evpn ] [ policy-options policy-statement EVPN-NO-MCAST term reject from nlri-route-type [ 6 7 8 10 ] ] [ policy-options policy-statement EVPN-NO-MCAST term reject then reject ] [ protocols bgp group <group> import EVPN-NO-MCAST ]
Tracking
Sign in to view the affected projects.
No advisories yet.
| Link | Providers |
|---|---|
| https://supportportal.juniper.net/JSA112187 |
|
Wed, 14 Oct 2026 17:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker sending a specifically malformed BGP EVPN multicast update which is attempted to be readvertised to cause an rpd crash. | |
| Title | Junos OS and Junos OS Evolved: An attacker sending a malformed update causes an rpd crash when BGP EVPN signaling is used | |
| Weaknesses | CWE-130 | |
| References |
| |
| Metrics |
cvssV3_1
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: juniper
Published:
Updated: 2026-10-14T17:19:36.170Z
Reserved: 2026-09-28T16:28:35.625Z
Link: CVE-2026-101962
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-14T18:17:11.777
Modified: 2026-10-14T18:17:11.777
Link: CVE-2026-101962
Redhat
No data.
OpenCVE Enrichment
No data.