Alert Type

SRN - Software Release Notification
Low/NotificationSoftware Release Notification
Low/NotificationSoftware Release Notification

Product Affected

QFX5000 running Junos Evolved software

Alert Description

Junos Software Service Release version 25.2X100-D35-EVO is now available for download from the Junos software download site

Download Junos Software Service Release:

  1. Go to Junos Platforms - Download Software page
  2. Input your product in the "Find a Product" search box
  3. From the Type/OS drop-down menu, select Junos SR
  4. From the Version drop-down menu, select your version
  5. Click the Software tab
  6. Select the Install Package as need and follow the prompts

NOTE: Starting on August 30th, 2024, we include PR's severity with each entry. See KB86335 [juniper.net] for the definition of PR's Severity

 

Junos Selective Update (JSU) feasible

Not applicable

Call to Action

For your review - see October 2026 PSIRT JSA announcement

Solution

Junos Software service Release version 25.2X100-D35-EVO is now available.

25.2X100-D35-EVO - List of Fixed issues

PR NumberSynopsisCategory: "agentd" software daemon
1954178
Critical		Junos OS Evolved: An attacker causes na-grpcd to crash when gRPC telemetry is enabled (CVE-2026-102012)
Product-Group=evo
Severity=Critical		A Reachable Assertion vulnerability in the na-grpcd process of Juniper Networks Junos OS and Junos EVO allows a remote unauthenticated attacker to cause a denial of service via a gRPC telemetry subscription request. Please refer to https://supportportal.juniper.net/JSA112250 [juniper.net] for more information.
1954180
Critical		Junos OS and Junos OS Evolved: An attacker causes na-grpcd to crash when the InitialSync service is used (CVE-2026-102013)
Product-Group=evo
Severity=Critical		A NULL Pointer Dereference vulnerability in the na-grpcd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated attacker with access to the chassis-internal network to cause a denial of service via a network message. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: Bi Directional Forwarding Detection (BFD)
1958106
Critical		Junos OS and Junos OS Evolved: An attacker causes a bfdd denial of service when BFD is enabled (CVE-2026-102058)
Product-Group=evo
Severity=Critical		A Reachable Assertion vulnerability in the bfdd daemon of Juniper Networks Junos OS and Junos OS Evolved platforms allows an unauthenticated adjacent attacker to cause a denial of service by restarting the daemon via crafted BFD session traffic. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: Border Gateway Protocol
1933049
Critical		Junos OS and Junos OS Evolved: If a specific set of BGP communities is present and graceful-shutdown sender is added while attempting to advertise rpd crashes (CVE-2026-103993)
Product-Group=evo
Severity=Critical		An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker which sends a specific set of BGP communities to cause a Denial-of-Service (DoS) as rpd crashes when graceful-shutdown sender community is added when attempting to advertise. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1952192
Critical		Junos OS and Junos OS Evolved: When BGP update-threading is enabled a specifically malformed flowspec NLRI causes routing-engine compromise (CVE-2026-102178)
Product-Group=evo
Severity=Critical		A Stack-based Buffer Overflow vulnerability in the BGP routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP flowspec peer to cause routing-engine compromise or a routing-daemon denial of service via flowspec route re-advertisement when BGP update-threading is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1952197
Critical		Junos OS and Junos OS Evolved: An attacker causes an rpd crash when BGP RIB streaming telemetry is in use (CVE-2026-102180)
Product-Group=evo
Severity=Critical		A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP peering session to cause a denial of service by sending a crafted BGP route attribute, which is processed while a BGP RIB streaming telemetry subscription is active. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1952737
Critical		Junos OS and Junos OS Evolved: An attacker causes a routing-daemon crash when BGP Prefix-SID routes are re-advertised (CVE-2026-33795)
Product-Group=evo
Severity=Critical		A Numeric Truncation Error vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker to cause a denial of service via a BGP Prefix-SID route advertisement that is subsequently re-advertised. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1953061
Critical		Junos OS and Junos OS Evolved: In a non-4byte-AS scenario a specific BGP update causes an rpd crash (CVE-2026-101976)
Product-Group=evo
Severity=Critical		An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an eBGP peer which has not negotiated four-octet-AS capability sending a specifically malformed BGP update to cause a Denial-of-Service (DoS). Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1953065
Critical		Junos OS and Junos OS Evolved: In a scenario with VPN-flowspec and BMP monitoring a specific BGP update causes an rpd crash (CVE-2026-101949)
Product-Group=evo
Severity=Critical		A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated remote BGP neighbor to cause a denial of service via a VPN-flowspec BGP update if it is readvertised and BMP post-policy RIB-out monitoring is configured. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1953085
Critical		Junos OS and Junos OS Evolved: A specific BGP ISO-VPN update causes an rpd crash when BMP or NSR is enabled (CVE-2026-101952)
Product-Group=evo
Severity=Critical		An Improper Validation of Consistency within Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP ISO-VPN peer to cause an rpd crash by sending a specific ISO-VPN update which is then processed by BMP route monitoring or NSR. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1953394
Critical		Junos OS and Junos OS Evolved: A remote BGP peer causes an rpd crash when long-lived graceful restart (LLGR) is used (CVE-2026-101957)
Product-Group=evo
Severity=Critical		An Improper Initialization vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote BGP peer to cause an rpd crash via an LLGR-stale route update readvertised to a configured non-LLGR peer group. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1953397
Critical		Junos OS and Junos OS Evolved: A malformed LSP-ping causes an rpd crash (CVE-2026-101959)
Product-Group=evo
Severity=Critical		A Function Call With Incorrect Variable or Reference as Argument vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause an rpd crash via specifically malformed LSP-ping. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1953399
Major		Junos OS Evolved: QFX Series: A BGP peer causes an rpd crash when global load balancing is enabled (CVE-2026-101960)
Product-Group=evo
Severity=Major		An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS Evolved on QFX5240, QFX5241 and QFX5250 configured for BGP global-load-balancing and more than 128 ecmp next-hops allows an attacker to cause an rpd crash. Please refer to https://supportportal.juniper.net/JSA112250 [juniper.net] for more information.
1953950
Critical		Junos OS and Junos OS Evolved: A specific BGP packet causes an rpd crash when an ECMP qualifier is used in an import policy (CVE-2026-101961)
Product-Group=evo
Severity=Critical		A NULL Pointer Dereference vulnerability in the routing-policy nexthop-ECMP matcher of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP peer to cause a routing-daemon denial of service via a specific BGP packet received while a nexthop-ecmp qualifier is attached to a BGP import policy. Refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1953962
Critical		Junos OS and Junos OS Evolved: An attacker causes a routing-daemon crash when BGP ISO-VPN egress protection is enabled (CVE-2026-101940)
Product-Group=evo
Severity=Critical		A NULL Pointer Dereference vulnerability in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated configured BGP peer to cause a denial of service via a BGP UPDATE when ISO-VPN and egress-protection configuration is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954000
Critical		Junos OS and Junos OS Evolved: An attacker causes rpd crash and denial of service when EVPN is configured (CVE-2026-101943)
Product-Group=evo
Severity=Critical		An Improper Input Validation vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker to cause a denial of service via a crafted BGP EVPN update message. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954487
Major		Junos OS and Junos OS Evolved: A BGP peer causes an rpd crash when labeled-unicast aggregate-label is configured (CVE-2026-101984)
Product-Group=evo
Severity=Major		A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-adjacent BGP peer to cause a denial of service when labeled-unicast aggregate-label is configured. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954857
Critical		Junos OS and Junos OS Evolved: A BGP peer causes an rpd crash when flow-spec routes are re-advertised (CVE-2026-101990)
Product-Group=evo
Severity=Critical		A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote configured BGP peer to cause an rpd crash or, on Junos OS, remote code-execution via sending a flow-spec update selected for re-advertisement. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954860
Critical		Junos OS and Junos OS Evolved: A BGP-LS peer causes heap data disclosure when traffic-engineering routing is enabled (CVE-2026-101991)
Product-Group=evo
Severity=Critical		An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP-LS peer to cause heap data disclosure via a malformed UPDATE sent over a session with the traffic-engineering address family enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956236
Critical		Junos OS and Junos OS Evolved: An attacker causes a routing-daemon crash when BGP RIB sharding is used (CVE-2026-102026)
Product-Group=evo
Severity=Critical		An Improper Control of a Resource Through its Lifetime vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent eBGP peer to cause a routing-daemon crash via a BGP route update when RIB sharding is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: BGP BMP Software
1952604
Critical		Junos OS and Junos OS Evolved: With BGP Monitoring Protocol is enabled, receipt of a specifically crafted BGP route update results in denial of service (CVE-2026-33789)
Product-Group=evo
Severity=Critical		A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated BGP peer to cause a denial of service and potential root-level command execution via crafted BGP route updates when the BGP Monitoring Protocol (BMP) is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1952739
Critical		Junos OS and Junos OS Evolved: An attacker causes remote root command execution when BMP route monitoring is enabled (CVE-2026-33796)
Product-Group=evo
Severity=Critical		A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured external BGP neighbor to execute arbitrary commands with root privileges via BMP route monitoring. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: EVO L3 routing for BCM XGS Platforms
1964882
Major		QFX5000 platforms - Enable TH5 BIST Diagnostics Test Run during ASIC initialization
Product-Group=evo
Severity=Major		Added a one-time built-in diagnostic check during system initialization. The test runs automatically after initial deployment, preserves its completion status across reboots and system resets, and records results for troubleshooting. Systems that pass continue normal startup, while failures are logged for investigation.
PR NumberSynopsisCategory: QFX Access Control related
1955815
Major		Junos OS: An ICCP peer causes dot1xd to crash when dot1x synchronization is enabled (CVE-2026-102069)
Product-Group=evo
Severity=Major		A Stack-based Buffer Overflow vulnerability in the dot1x daemon of Juniper Networks Junos OS devices operating as Junos Fusion Aggregation Devices allows an adjacent attacker acting as the configured ICCP peer to cause a denial of service and potentially execute code as root via. The issue is triggered when dot1x synchronization is enabled for the required Fusion satellite topology. Please refer to https://supportportal.juniper.net/JSA112188 [juniper.net] for more information.
1956093
Critical		Junos OS and Junos OS Evolved: An attacker causes root code execution when 802.1X authentication is used (CVE-2026-102015)
Product-Group=evo
Severity=Critical		A Heap-based Buffer Overflow vulnerability in the secure-dot1xd process of Juniper Networks on Junos OS and Junos OS Evolved allows an unauthenticated adjacent network attacker to execute code as root or cause a denial of service via an EAPOL frame sent to an 802.1X-authenticated interface. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: EVO cfmd RE related PRs
1957845
Critical		Junos OS and Junos OS Evolved: MX Series, PTX Series: An attacker causes remote code execution and denial of service when enhanced CFM is enabled (CVE-2026-102055)
Product-Group=evo
Severity=Critical		A Stack-based Buffer Overflow vulnerability in the cfmd process of Juniper Networks Junos OS on MX Series and Junos OS Evolved on PTX Series platforms allows an unauthenticated adjacent-network attacker to execute arbitrary code as root or cause denial of service via a specific CFM Message sent to a configured down-MEP with enhanced CFM mode enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1957850
Critical		Junos OS and Junos OS Evolved: An attacker causes denial of service and information disclosure when Ethernet CFM is enabled (CVE-2026-102056)
Product-Group=evo
Severity=Critical		An Out-of-bounds Read vulnerability in the cfmd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent-network attacker to crash the daemon and disclose limited process memory via a specific CFM Message sent to a configured interface. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: Firewall related development
1956227
Critical		Junos OS Evolved: An attacker causes denial of service via SNMP when firewall counters are used (CVE-2026-102023)
Product-Group=evo
Severity=Critical		A Reachable Assertion vulnerability in fwstatsd of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause a denial of service via an SNMP firewall-counter MIB query when at least one firewall counter is configured. Please refer to https://supportportal.juniper.net/JSA112250 [juniper.net] for more information.
PR NumberSynopsisCategory: EVO Socket replication
1955807
Critical		Junos OS Evolved: Malformed TCP key-chain traffic causes a kernel panic when BGP or LDP key-chain authentication is used (CVE-2026-102068)
Product-Group=evo
Severity=Critical		A Stack-based Buffer Overflow vulnerability in the kernel of Juniper Networks Junos OS Evolved allows an unauthenticated remote attacker to trigger a kernel panic via a crafted TCP packet when key-chain authentication is used for BGP or LDP. Please refer to https://supportportal.juniper.net/JSA112250 [juniper.net] for more information.
PR NumberSynopsisCategory: AAA, auditd issues
1956332
Critical		Junos OS Evolved: A low-privileged TACACS+ user causes root command execution when authorization refresh is enabled (CVE-2026-102031)
Product-Group=evo
Severity=Critical		An OS Command Injection vulnerability in tacacs of Juniper Networks Junos OS Evolved allows a low-privileged TACACS+-authenticated user to execute commands with root privileges when periodic TACACS+ authorization-refresh is enabled. Please refer to https://supportportal.juniper.net/JSA112250 [juniper.net] for more information.
PR NumberSynopsisCategory: eventd, syslog infra issues
1953680
Critical		Junos OS and Junos OS Evolved: An attacker causes Denial of Service in eventd (CVE-2026-101934)
Product-Group=evo
Severity=Critical		An Out-of-bounds Write vulnerability in eventd of Juniper Networks Junos OS and Junos OS Evolved allows a local attacker to cause a Denial of Service (DoS) via sending a crafted packet to the eventd relay service. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: EVPN control plane issues
1952196
Critical		Junos OS and Junos OS Evolved: An attacker causes a routing daemon crash when BGP EVPN RIB telemetry is used (CVE-2026-102179)
Product-Group=evo
Severity=Critical		An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP EVPN peer to cause a denial of service via BGP EVPN route processing when the l2vpn-evpn RIB telemetry sensor is subscribed. Successful exploitation can crash rpd and interrupt routing protocols until the daemon restarts and reconverges. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1952476
Major		Junos OS and Junos OS Evolved: If in a BGP EVPN scenario a malformed NLRI is received rpd crashes (CVE-2026-102183)
Product-Group=evo
Severity=Major		An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP EVPN peer to cause an rpd crash via a specifically malformed NLRI. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1952492
Critical		Junos OS and Junos OS Evolved: A malformed EVPN SRv6 route causes an rpd crash (CVE-2026-102184)
Product-Group=evo
Severity=Critical		An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos Evolved platforms allows a configured EVPN signaling peer to cause an rpd crash via a malformed SRv6 structure carried in an EVPN route update. The result is a denial of service affecting routing adjacencies. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1952495
Critical		Junos OS and Junos OS Evolved: An attacker causes an rpd denial of service when EVPN multihoming preference-based DF election is used (CVE-2026-102185)
Product-Group=evo
Severity=Critical		A Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote network attacker to cause a denial of service via EVPN multihoming with preference-based designated-forwarder election. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1953998
Critical		Junos OS and Junos OS Evolved: An attacker causes rpd denial of service when EVPN route signaling is used (CVE-2026-101942)
Product-Group=evo
Severity=Critical		An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker to cause a denial of service via a malformed EVPN Type-3 or Type-4 route received from a configured EVPN peer and processed during re-advertisement. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954001
Critical		Junos OS and Junos OS Evolved: An attacker causes a routing protocol daemon denial of service when EVPN is used (CVE-2026-101944)
Product-Group=evo
Severity=Critical		An Integer Overflow or Wraparound vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker to cause a denial of service via specially crafted EVPN route updates from an accepted EVPN BGP peer. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954002
Critical		Junos OS and Junos OS Evolved: An attacker causes routing daemon denial of service when EVPN BGP is enabled (CVE-2026-101945)
Product-Group=evo
Severity=Critical		An Integer Overflow or Wraparound vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a remote attacker with an established EVPN BGP peering relationship to cause a denial of service via EVPN BGP route processing. The issue affects EVPN-enabled routing instances and can disrupt control-plane adjacencies. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954029
Major		Junos OS and Junos OS Evolved: A BGP EVPN neighbor causes an rpd crash when SRv6 multihoming is used (CVE-2026-101963)
Product-Group=evo
Severity=Major		An Incorrect Calculation vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos EVO allows a remote BGP EVPN neighbor to cause an rpd crash when SRv6 EVPN multihoming is configured.Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954478
Critical		Junos OS and Junos OS Evolved: A EVPN peer causes an rpd crash or root-level compromise when EVPN-VPWS is used (CVE-2026-101982)
Product-Group=evo
Severity=Critical		A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP/EVPN peer to cause root code execution on Junos OS or an rpd crash on Junos OS Evolved via protocol-valid route advertisements for an EVPN-VPWS service. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: Control plane EVPN multicast
1953997
Major		Junos OS and Junos OS Evolved: An attacker sending a malformed update causes an rpd crash when BGP EVPN signaling is used (CVE-2026-101962)
Product-Group=evo
Severity=Major		An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker sending a specifically malformed BGP EVPN multicast update which is attempted to be readvertised to cause an rpd crash. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: Internet Group Management Protocol
1958122
Critical		Junos OS and Junos OS Evolved: MX Series, ACX Series: An attacker causes a routing daemon crash when multicast lawful intercept is used (CVE-2026-102060)
Product-Group=evo
Severity=Critical		A NULL Pointer Dereference vulnerability in the rpd process of Juniper Networks Junos OS on MX Series and Junos OS Evolved on ACX Series allows an unauthenticated adjacent attacker to cause a denial of service via an IGMPv3 membership report received on a directly connected network. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: ISIS routing protocol
1951942
Critical		Junos OS and Junos OS Evolved: An out-of-bounds write causes an rpd crash when IS-IS backup selection is used (CVE-2026-102177)
Product-Group=evo
Severity=Critical		An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service when IS-IS link protection and backup-selection are configured. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954540
Critical		Junos OS and Junos OS Evolved: A specific IS-IS SRv6 packet causes an rpd crash when flexible algorithm is used (CVE-2026-101987)
Product-Group=evo
Severity=Critical		An Improper Validation of Specified Quantity in Input vulnerability in the routing daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause a denial of service by sending a specific IS-IS SRv6 packet when SRv6 and Flexible Algorithm are enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: Category for JET(JUNOS Extension Toolkit) related issues
1963718
Major		Junos OS: An authenticated attacker causes a denial of service when the gRPC extension-service is enabled (CVE-2026-102072)
Product-Group=evo
Severity=Major		An Improper Handling of Highly Compressed Data vulnerability in the gRPC library used by na-grpcd of Juniper Networks Junos OS allows an authenticated network-based attacker to cause a denial of service via a compressed gRPC request. Please refer to https://supportportal.juniper.net/JSA112188 [juniper.net] for more information.
PR NumberSynopsisCategory: Layer 2 Control Module
1957359
Critical		Junos OS and Junos OS Evolved: An attacker causes l2cpd denial of service when MVRP is used (CVE-2026-102047)
Product-Group=evo
Severity=Critical		An Improper Validation of Consistency within Input vulnerability in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated Layer 2 attacker to cause a denial of service in associated Layer 2 control protocols via a crafted MVRP Ethernet frame sent to an MVRP-enabled interface. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1957363
Critical		Junos OS and Junos OS Evolved: An attacker causes l2cpd crash or root code execution when Unified Access Policy is enabled (CVE-2026-102049)
Product-Group=evo
Severity=Critical		A Stack-based Buffer Overflow vulnerability in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service or execute arbitrary code with root privileges via LLDP traffic received on an interface with Unified Access Policy enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1957368
Critical		Junos OS and Junos OS Evolved: An adjacent attacker causes Layer 2 control-plane denial of service when LLDP is enabled (CVE-2026-102050)
Product-Group=evo
Severity=Critical		A Stack-based Buffer Overflow vulnerability in the l2cpd daemon of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service in Layer 2 control-plane processing via LLDP packets received on an interface configured for LLDP. Repeated triggering may disrupt LLDP and other Layer 2 control protocols across the device. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1957373
Critical		Junos OS and Junos OS Evolved: An attacker causes l2cpd memory exhaustion when LLDP fast receive processing is enabled (CVE-2026-102051)
Product-Group=evo
Severity=Critical		An Improper Release of Memory Before Removing Last Reference vulnerability in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved platforms allows an adjacent unauthenticated attacker to cause l2cpd memory exhaustion and Layer 2 control-plane disruption via LLDP traffic when fast receive processing is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: Layer2 forwarding on EX/NFX/PTX/QFX
1956577
Critical		Junos OS and Junos OS Evolved: Unintended L2ALD memory allocation causes a denial of service when static MAC IP configurations are present (CVE-2026-102032)
Product-Group=evo
Severity=Critical		A Missing Release of Memory after Effective Lifetime vulnerability in the l2ald process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via crafted packets when the static MAC-IP feature is in use. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956583
Critical		Junos OS and Junos OS Evolved: An attacker causes a denial of service when MC-LAG IRB MAC synchronization is enabled (CVE-2026-102035)
Product-Group=evo
Severity=Critical		A Reachable Assertion vulnerability in l2ald of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause a denial of service via an ICCP peer message when MC-LAG IRB MAC synchronization is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956599
Critical		Junos OS and Junos OS Evolved: An EVPN default-gateway route burst causes l2ald denial of service (CVE-2026-102036)
Product-Group=evo
Severity=Critical		An Integer Overflow or Wraparound vulnerability in the l2ald process of Juniper Networks Junos OS and Junos OS Evolved allows a configured EVPN BGP peer to cause a denial of service via EVPN Type-2 MAC/IP routes. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1957705
Critical		Junos OS and Junos OS Evolved: An EVPN-VXLAN memory leak causes denial of service when active-active multihoming is used (CVE-2026-102053)
Product-Group=evo
Severity=Critical		An Improper Release of Memory Before Removing Last Reference vulnerability in the l2ald process of Juniper Networks Junos OS and Junos OS Evolved on QFX5K-family platforms allows a configured EVPN peer to cause a denial of service through memory exhaustion via EVPN-VXLAN active-active multihoming route processing. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1957710
Critical		Junos OS and Junos OS Evolved: Insufficient validation of VXLAN overlay ping causes information disclosure when EVPN-VXLAN is configured (CVE-2026-102054)
Product-Group=evo
Severity=Critical		An Improper Handling of Length Parameter Inconsistency vulnerability in L2ALM of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to obtain stale PFE packet memory via VXLAN overlay-ping traffic sent to a local VTEP. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: lacp protocol
1956919
Critical		Junos OS Evolved: An crafted LACP frame causes lacpd to crash when LACP is enabled (CVE-2026-102045)
Product-Group=evo
Severity=Critical		An Out-of-bounds Write vulnerability in lacpd of Juniper Networks Junos OS Evolved allows a Layer-2-adjacent attacker to cause a denial of service via a crafted frame received on an LACP-enabled aggregated-Ethernet member port. Refer to https://supportportal.juniper.net/JSA112250 [juniper.net]
PR NumberSynopsisCategory: Label Distribution Protocol
1954119
Critical		Junos OS and Junos OS Evolved: An attacker causes rpd to crash when LDP is enabled (CVE-2026-101999)
Product-Group=evo
Severity=Critical		A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos EVO allows an adjacent attacker to cause a denial of service via an established LDP session carrying an IPv6 Prefix FEC in a specific Label message. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954120
Critical		Junos OS and Junos OS Evolved: An attacker causes rpd to crash when LDP is enabled (CVE-2026-102000)
Product-Group=evo
Severity=Critical		A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos EVO allows an adjacent unauthenticated attacker to cause a denial of service via LDP control traffic. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954127
Critical		Junos OS and Junos OS Evolved: An attacker causes rpd to crash when LDP link protection is enabled (CVE-2026-102011)
Product-Group=evo
Severity=Critical		A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos EVO allows an adjacent attacker to cause a denial of service via an established LDP session when two misconfigured neighbors (or one neighbor duplicated by an L2 loop) advertise the same transport address on a link-protected interface. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: JDHCP is a daemon for EVO platform to handle DHCP protocol
1957664
Critical		Junos OS and Junos OS Evolved: An attacker causes jdhcpd to crash when the DHCPv4 local-client feature is used (CVE-2026-102052)
Product-Group=evo
Severity=Critical		A Stack-based Buffer Overflow vulnerability in the jdhcpd process of Juniper Networks Junos OS and Junos OS Evolved platforms allows an adjacent unauthenticated attacker to cause denial of service or execute arbitrary code with root privileges via a malformed DHCPv4 server response when the DHCPv4 local-client feature is used. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1957862
Critical		Junos OS: An attacker causes DHCP service disruption during DHCP client operation (CVE-2026-102057)
Product-Group=evo
Severity=Critical		A Stack-based Buffer Overflow vulnerability in the jdhcpd process of Juniper Networks Junos OS allows an unauthenticated adjacent attacker to cause a denial of service via a DHCP client response. The issue affects DHCP client operation and can interrupt related DHCP, relay, and zero-touch-provisioning services. Please refer to https://supportportal.juniper.net/JSA112188 [juniper.net] for more information.
PR NumberSynopsisCategory: mc-ae interface
1954885
Major		Junos OS and Junos OS Evolved: Malformed MC-LAG ICCP message causes l2ald heap disclosure or crash (CVE-2026-101994)
Product-Group=evo
Severity=Major		An Improper Handling of Length Parameter Inconsistency vulnerability in the l2ald daemon of Juniper Networks Junos OS and Junos OS Evolved allows an attacker who can control or impersonate a configured MC-LAG ICCP peer to disclose process heap memory or cause a denial of service via a malformed ICCP message. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954888
Major		Junos OS and Junos OS Evolved: Malformed ICCP packets cause l2ald memory disclosure and disruption (CVE-2026-101995)
Product-Group=evo
Severity=Major		An Improper Validation of Specified Quantity in Input vulnerability in the l2ald of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker with access to an ICCP peer session to cause memory disclosure and disruption of the l2ald daemon via malformed ICCP packets. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954889
Major		Junos OS and Junos OS Evolved: An inconsistent ICCP peer message causes an l2ald crash when MC-LAG is configured (CVE-2026-101996)
Product-Group=evo
Severity=Major		A Reachable Assertion vulnerability in the l2ald daemon of Juniper Networks Junos OS and Junos OS Evolved devices configured for MC-LAG/ICCP allows an adjacent attacker to cause a denial of service via an inconsistent ICCP peer message. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956578
Critical		Junos OS and Junos OS Evolved: An attacker causes denial of service when MC-LAG MAC synchronization is enabled (CVE-2026-102033)
Product-Group=evo
Severity=Critical		An Improper Validation of Specified Quantity in Input vulnerability in l2ald of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause a denial of service via an ICCP MC-LAG message. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956580
Critical		Junos OS and Junos OS Evolved: An attacker causes l2ald to restart when MC-LAG ICCP MAC synchronization is enabled (CVE-2026-102034)
Product-Group=evo
Severity=Critical		A Reachable Assertion vulnerability in the l2ald daemon of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured ICCP peer to cause a denial of service via a malformed MC-LAG message. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: Multiprotocol Label Switching
1956673
Critical		Junos OS and Junos OS Evolved: An attacker causes a routing control-plane denial of service when BGP-LS traffic engineering is enabled (CVE-2026-102044)
Product-Group=evo
Severity=Critical		A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP-LS peer to cause a denial of service via a BGP-LS update. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: Multicast for L3VPNs
1953081
Critical		Junos OS and Junos OS Evolved: A BGP peer causes an rpd crash if a malformed MCAST-TREE NLRI is received and readvertised (CVE-2026-101951)
Product-Group=evo
Severity=Critical		An Improper Validation of Consistency within Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-adjacent configured BGP peer to cause a denial of service by sending a specifically malformed BGP MCAST-TREE update and this NLRI is then attempted to be readvertised. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954493
Major		Junos OS Evolved: PTX Series: An IS-IS peer causes an rpd crash when BIER over IS-IS is enabled (CVE-2026-101985)
Product-Group=evo
Severity=Major		A Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS Evolved on PTX Series allows an unauthenticated IS-IS peer to cause a denial of service. Please refer to https://supportportal.juniper.net/JSA112250 [juniper.net] for more information.
1955224
Major		Junos OS and Junos OS Evolved: An attacker causes an rpd crash when inter-AS MVPN ingress replication is used (CVE-2026-102064)
Product-Group=evo
Severity=Major		A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker to cause rpd crash via malformed BGP MCAST-VPN updates from a configured eBGP peer. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956148
Critical		Junos OS and Junos OS Evolved: An attacker causes a routing outage when BGP MVPN signaling is enabled (CVE-2026-102016)
Product-Group=evo
Severity=Critical		An Improper Validation of Specified Quantity in Input vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP MVPN peer to cause a denial of service via a BGP MVPN signaling update. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956262
Critical		Junos OS and Junos OS Evolved: An attacker causes routing-daemon denial of service when BGP MVPN inter-region tunneling is used (CVE-2026-102030)
Product-Group=evo
Severity=Critical		An Incomplete Cleanup vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a configured MVPN neighbor to cause a denial of service via a BGP MVPN update when an interregion segmented VRF with 'protocols mvpn inter-region-template' is configured. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: OSPF routing protocol
1951247
Critical		Junos OS and Junos OS Evolved: Malformed OSPF packets causes routing disruption when OSPF is enabled (CVE-2026-101972)
Product-Group=evo
Severity=Critical		An Integer Overflow or Wraparound vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via specific OSPFv2 packets sent on an OSPF-enabled interface. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1951273
Critical		Junos OS and Junos OS Evolved: Malformed OSPF packets cause rpd memory disclosure or service disruption when link-local TE processing is used (CVE-2026-101974)
Product-Group=evo
Severity=Critical		An Improper Validation of Specified Quantity in Input vulnerability in rpd of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent OSPF peer to disclose rpd memory or cause a rpd crash via a malformed OSPF packets. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1951277
Critical		Junos OS and Junos OS Evolved: Improper OSPF LSA validation causes an rpd crash when prefix-SID best-route installation is used (CVE-2026-101975)
Product-Group=evo
Severity=Critical		A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent OSPF peer to cause a denial of service via OSPF traffic processed while OSPF Source Packet Routing best-route Prefix-SID installation is configured. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: MPLS Point-to-Multipoint TE
1954123
Major		Junos OS and Junos OS Evolved: An attacker can cause an rpd crash via a crafted LDP message (CVE-2026-101964)
Product-Group=evo
Severity=Major		A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause an rpd crash via a crafted LDP packet received over an established LDP session. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954449
Major		Junos OS and Junos OS Evolved: An adjacent LDP peer causes routing-engine compromise when LDP is enabled (CVE-2026-101981)
Product-Group=evo
Severity=Major		A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent LDP peer to cause an rpd crash or execute arbitrary code via a malformed LDP Label Mapping message. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954545
Major		Junos OS and Junos OS Evolved: An unauthenticated adjacent attacker causes an rpd crash when LDP is enabled (CVE-2026-101988)
Product-Group=evo
Severity=Major		A NULL Pointer Dereference vulnerability in the routing protcol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via LDP messages received over an operational LDP session. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954547
Major		Junos OS and Junos OS Evolved: An crafted LDP message causes an rpd crash when LDP is enabled (CVE-2026-101989)
Product-Group=evo
Severity=Major		A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a compromised LDP neighbor to cause an rpd crash via a crafted LDP message. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: Phone-Home-Client Infrastructure
1954221
Critical		Junos OS Evolved: PTX Series: An attacker controlled DHCP response causes root-level compromise when zero-touch provisioning is used (CVE-2026-101967)
Product-Group=evo
Severity=Critical		An OS Command Injection vulnerability in the bootzd zero-touch provisioning daemon of Juniper Networks Junos OS Evolved allows an unauthenticated attacker on the management LAN to execute commands as root via crafted DHCP response if the management-instance configuration enabled. Please refer to https://supportportal.juniper.net/JSA112250 [juniper.net] for more information.
1954222
Critical		Junos OS Evolved: PTX Series: An attacker controlled gRPC response causes root-level compromise when zero-touch provisioning is used (CVE-2026-101978)
Product-Group=evo
Severity=Critical		An OS Command Injection vulnerability in the bootzd zero-touch provisioning daemon of Juniper Networks Junos OS Evolved allows an unauthenticated attacker on the management LAN to execute commands as root via a crafted gRPC response. Please refer to https://supportportal.juniper.net/JSA112250 [juniper.net] for more information.
1958116
Critical		Junos OS and Junos OS Evolved: EX Series, SRX Series, QFX Series: A rogue DHCP server causes root-level command execution when the phone-home client processes specific information (CVE-2026-102059)
Product-Group=evo
Severity=Critical		An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the phone-home daemon (phcd) of Juniper Networks Junos OS and Junos OS Evolved on EX Series, SRX Series, and QFX Series allows an adjacent unauthenticated attacker to execute arbitrary commands with root privileges via a rogue DHCP server. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1958129
Major		Junos OS and Junos OS Evolved: An attacker causes root code execution when SZTP DHCP provisioning is used (CVE-2026-102061)
Product-Group=evo
Severity=Major		A Stack-based Buffer Overflow vulnerability in the phone-home daemon (phcd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to execute arbitrary code as root via a crafted DHCP SZTP bootstrap message. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: Protocol Independant Multicast
1956154
Critical		Junos OS and Junos OS Evolved: An attacker causes routing-plane denial of service when Auto-RP mapping is enabled (CVE-2026-102017)
Product-Group=evo
Severity=Critical		An Out-of-bounds Write vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated attacker to cause a routing-plane denial of service via Auto-RP mapping announcements received when Auto-RP mapping is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956156
Critical		Junos OS and Junos OS Evolved: Malformed PIM Bidir DF-Election messages cause routing service disruption when bidirectional PIM is enabled (CVE-2026-102018)
Product-Group=evo
Severity=Critical		A NULL Pointer Dereference vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial-of-service condition via a malformed PIM Bidir message. Refer to https://supportportal.juniper.net/JSA112187 [juniper.net]
1958191
Critical		Junos OS and Junos OS Evolved: An unauthenticated attacker causes rpd denial of service when IPv6 PIM is enabled (CVE-2026-101969)
Product-Group=evo
Severity=Critical		An Improper Input Validation vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via a malformed PIM Hello message received on an IPv6-enabled PIM interface. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1958197
Critical		Junos OS and Junos OS Evolved: Specific PIM messages causes rpd crash when multiple-triggered-joins is used (CVE-2026-101970)
Product-Group=evo
Severity=Critical		A Use After Free vulnerability in the rpd PIM Join/Prune processing of Juniper Networks Junos OS and Junos OS Evolved platforms allows an unauthenticated adjacent attacker to crash the routing daemon via specific PIM messages when sparse mode PIM is configured. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: Issues related to PKI daemon
1951251
Critical		Junos OS: Malformed packet causes pkid denial of service when certificate re-enrollment is used (CVE-2026-101973)
Product-Group=evo
Severity=Critical		A NULL Pointer Dereference vulnerability in the pkid component of Juniper Networks Junos OS allows an unauthenticated remote attacker to cause a denial of service via a malformed packet received during CMP enrollment or automatic certificate re-enrollment. Please refer to https://supportportal.juniper.net/JSA112188 [juniper.net] for more information.
PR NumberSynopsisCategory: Routing Information Protocol
1956181
Critical		Junos OS and Junos OS Evolved: Malformed RIPv2 messages cause routing service disruption when RIP is enabled (CVE-2026-102019)
Product-Group=evo
Severity=Critical		An Improper Validation of Specified Quantity in Input vulnerability in the rpd process of Juniper Networks Junos OS and Junos Evolved allows an unauthenticated adjacent attacker to cause a denial-of-service condition via a malformed RIPv2 message. Refer to https://supportportal.juniper.net/JSA112187 [juniper.net]
PR NumberSynopsisCategory: rosen-6 and rosen-7 mvpn bugs
1958185
Major		Junos OS and Junos OS Evolved: EX Series, MX Series, ACX Series: An attacker causes rpd heap memory disclosure when Rosen-MVPN data-MDT is enabled (CVE-2026-101968)
Product-Group=evo
Severity=Major		An Integer Underflow (Wrap or Wraparound) vulnerability in the rpd process of Juniper Networks Junos OS on EX Series and MX Series, and Junos OS Evolved on ACX Series allows an unauthenticated adjacent attacker to cause heap memory disclosure and multicast join-state injection via a malformed Rosen-MVPN message. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: Issues related to dynamic-tunnels routing infrastructure
1955227
Major		Junos OS and Junos OS Evolved: A malformed SRv6 service route causes an rpd crash when dynamic tunnels are enabled (CVE-2026-102065)
Product-Group=evo
Severity=Major		An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated BGP peer to cause an rpd crash via a malformed BGP-signaled SRv6 service route when SRv6 dynamic tunnels are enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: RPD Next-hop issues including indirect, CNH, and MCNH
1955220
Minor		Junos OS: MX Series: An unauthenticated network attacker causes an rpd crash when HFRR link protection is used (CVE-2026-102063)
Product-Group=evo
Severity=Minor		A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos on MX Series routers allows an unauthenticated network attacker to cause a denial of service via an eBGP route update when HFRR link protection is configured in a VRF. Please refer to https://supportportal.juniper.net/JSA112196 [juniper.net] for more information.
PR NumberSynopsisCategory: RPD policy options
1953062
Critical		Junos OS and Junos OS Evolved: A specific BGP packet causes an rpd crash when ephemeral configuration is used (CVE-2026-101977)
Product-Group=evo
Severity=Critical		A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP peer to cause a persistent routing-daemon denial of service via a specific BGP packet when ephemeral configuration is used. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1953064
Critical		Junos OS and Junos OS Evolved: A specific BGP FlowSpec update causes an rpd crash when BGP FlowSpec import policy is used (CVE-2026-101948)
Product-Group=evo
Severity=Critical		A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated BGP peer to cause a denial of service via a specific BGP FlowSpec update received by an affected BGP session. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1953954
Critical		Junos OS and Junos OS Evolved: A routing-policy table reference causes routing-daemon denial of service when source-based forwarding is used (CVE-2026-101939)
Product-Group=evo
Severity=Critical		A NULL Pointer Dereference vulnerability in the routing protocol daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows a configured peer sending a BGP UPDATE to cause a denial of service when an import policy with `then source-based-forwarding next-hop next-table ` is configured to reference a routing table that does not exist. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1953965
Critical		Junos OS and Junos OS Evolved: An attacker causes an rpd crash when routing-policy resolution-map processing and policy event tracing are enabled (CVE-2026-101941)
Product-Group=evo
Severity=Critical		A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP neighbor to cause a denial of service via a BGP route update when specific routing-policy resolution-map and policy event-tracing configuration is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: Issues related route resolution routing infrastructure
1956239
Critical		Junos OS and Junos OS Evolved: A configured BGP neighbor causes rpd crash when multipath next-hops are processed (CVE-2026-102027)
Product-Group=evo
Severity=Critical		An Incorrect Calculation of Buffer Size vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP neighbor to cause an rpd crash via BGP labeled-unicast UPDATEs when the affected multipath features are enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: RPD route tables, resolver, routing instances, static routes
1956233
Critical		Junos OS and Junos OS Evolved: An attacker causes a routing daemon crash when BGP extended-nexthop-tunnel is used (CVE-2026-102024)
Product-Group=evo
Severity=Critical		An Integer Overflow or Wraparound vulnerability in the routing daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated BGP peer to cause a denial of service via BGP route updates when extended-nexthop-tunnel is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956235
Critical		Junos OS and Junos OS Evolved: A BGP route-processing error causes rpd crash when extended next-hop tunneling and SRv6 service processing are used (CVE-2026-102025)
Product-Group=evo
Severity=Critical		A Mismatched Memory Management Routines vulnerability in the routing protocol daemon (rpd) process of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated network-based attacker to cause a denial of service via a BGP route update when extended next-hop tunneling and SRv6 service processing are used. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: multicast source distribution protocol
1956260
Critical		Junos OS and Junos OS Evolved: An attacker causes routing-daemon denial of service when an MSDP or PIM policy uses AS-path expansion (CVE-2026-102029)
Product-Group=evo
Severity=Critical		A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated configured MSDP peer or adjacent PIM sender to cause a denial of service via an MSDP or PIM policy that uses AS-path expansion. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: Resource Reservation Protocol
1955230
Critical		Junos OS and Junos OS Evolved: Malformed RSVP packet causes a rpd crash when RSVP is enabled (CVE-2026-102066)
Product-Group=evo
Severity=Critical		A Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service via a malformed RSVP packet when RSVP is enabled on the receiving interface. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1955500
Major		Junos OS and Junos OS Evolved: A specific RSVP packet causes an rpd crash when L2 LSP support is used (CVE-2026-102067)
Product-Group=evo
Severity=Major		An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service via a crafted RSVP packet when L2 LSP support is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information
1956204
Critical		Junos OS and Junos OS Evolved: Malformed RSVP packet causes rpd crash when MPLS-TE error processing is enabled (CVE-2026-102021)
Product-Group=evo
Severity=Critical		A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent network attacker to cause a denial of service via a crafted RSVP packet when MPLS-TE RSVP processing is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956651
Critical		Junos OS and Junos OS Evolved: An attacker causes routing-process denial of service when GMPLS EVPL dynamic transport is used (CVE-2026-102039)
Product-Group=evo
Severity=Critical		A NULL Pointer Dereference vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause a denial of service via a malformed RSVP Path message received on an EVPL LMP control channel. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956653
Critical		Junos OS and Junos OS Evolved: An attacker crashes the routing daemon when co-routed bidirectional RSVP LSPs are used (CVE-2026-102040)
Product-Group=evo
Severity=Critical		A NULL Pointer Dereference vulnerability in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to crash the routing daemon and cause a denial of service via an RSVP Path message. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956659
Critical		Junos OS and Junos OS Evolved: An attacker causes a routing daemon crash when RSVP is enabled (CVE-2026-102041)
Product-Group=evo
Severity=Critical		A Reachable Assertion vulnerability in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated network attacker to cause a denial of service via malformed RSVP signaling when RSVP is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956663
Critical		Junos OS and Junos OS Evolved: An attacker causes rpd to crash when RSVP associated-bidirectional LSP is enabled (CVE-2026-102042)
Product-Group=evo
Severity=Critical		A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to crash the routing process via RSVP-TE associated-bidirectional LSP signaling. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1962883
Major		Junos OS and Junos OS Evolved: Specific RSVP packet causes an rpd crash when associated bidirectional LSP is enabled (CVE-2026-102071)
Product-Group=evo
Severity=Major		A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via a specific RSVP packet. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: SNMP Infrastructure (snmpd, mib2d)
1954250
Critical		Junos OS and Junos OS Evolved: A network attacker causes root-level code execution or denial of service when SNMP and AAA are enabled (CVE-2026-101979)
Product-Group=evo
Severity=Critical		A Stack-based Buffer Overflow vulnerability in the authd Juniper Networks Junos OS and Junos OS Evolved allows a network attacker with SNMP read access to execute code with root privileges or cause a denial of service via a specific SNMP packet, when SNMP and AAA are enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: Segment routing traffic Engineering
1956203
Critical		Junos OS and Junos OS Evolved: An attacker causes an rpd denial of service when BGP-LS TED export is enabled (CVE-2026-102020)
Product-Group=evo
Severity=Critical		A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated network-based attacker to cause a denial of service via BGP-LS routing updates. Refer to https://supportportal.juniper.net/JSA112187 [juniper.net]
1956205
Critical		Junos OS and Junos OS Evolved: An attacker causes a routing-process crash when BGP-LS traffic-engineering is enabled (CVE-2026-102022)
Product-Group=evo
Severity=Critical		A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP-LS peer to cause an rpd crash via a crafted BGP-LS Link NLRI advertisements. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: UI Infrastructure - mgd, DAX API, DDL/ODL
1951668
Critical		Junos OS and Junos OS Evolved: An attacker causes remote code execution or denial of service when service-deployment processing is used (CVE-2026-102175)
Product-Group=evo
Severity=Critical		A Heap-based Buffer Overflow vulnerability in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated attacker who can control or intercept the configured SDX/SRC server connection to execute code as root or cause denial of service via a crafted frame received over the service-deployment TCP connection. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: Issues related to Logging/Tracing, errmsg, eventd infrastruc
1953674
Critical		Junos OS and Junos OS Evolved: An unprivileged local attacker causes denial of service or privilege escalation (CVE-2026-101927)
Product-Group=evo
Severity=Critical		A Heap-based Buffer Overflow vulnerability in eventd of Juniper Networks Junos OS and Junos OS Evolved on all platforms allows an unprivileged local attacker to cause a denial of service (DoS) or achieve privilege escalation to root via crafted IPC event messages. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: Virtual Private LAN Services
1954879
Major		Junos OS and Junos OS Evolved: A BGP peer causes an rpd crash when automatic VPLS site ID is used (CVE-2026-101992)
Product-Group=evo
Severity=Major		An Improper Input Validation vulnerability in the routing protocol daemon (rpd) process of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP peer to cause an rpd crash via a BGP VPLS signaling update. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954880
Major		Junos OS and Junos OS Evolved: An eBGP peer causes an rpd crash when VPLS automatic site-ID collision resolution is used (CVE-2026-101993)
Product-Group=evo
Severity=Major		A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent eBGP peer to cause a denial of service via a VPLS signaling update when automatic site-ID negotiation is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956248
Critical		Junos OS and Junos OS Evolved: An attacker causes an rpd crash when VPLS auto-discovery is used (CVE-2026-102028)
Product-Group=evo
Severity=Critical		A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote BGP peer to cause a denial of service when multiple UPDATEs occur over a single TCP session with 'bgp family l2vpn auto-discovery-only' configured. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.

 

 

25.2X100-D35-EVO - List of Known issues

PR NumberSynopsisCategory: EVO linux defects & enhancement requests
1867244
Major		All engineering-supported releases of Junos OS and Junos OS Evolved on all platforms are not vulnerable CVE-2025-0167 CVE-2025-0665 CVE-2025-0725
Product-Group=evo		Upon engineering evaluation of these three CVE IDs, Juniper Networks has determined that all engineering-supported releases of Junos OS and Junos OS Evolved on all platforms are not vulnerable CVE-2025-0167 CVE-2025-0665 CVE-2025-0725. While there is no risk associated with these 3 CVE IDs, customers are advised to follow current IETF Security Best Current Practices, including but not limited to restricting access to authorized users, devices, and networks.

Resolved In: evo:25.4R1-EVO evo:25.4R2-EVO
PR NumberSynopsisCategory: Category for QFX5K EVO Platform Software PRs related to Inte
1836697
Major		QFX5700: Incorrect carrier-transitions observed in SFP56-50G-DAC-3M after router reboot
Product-Group=evo		Link with the DAC (SFP56-50G-DAC-3M ) comes up with 25G default speed configuration when switch is rebooted. Hence, when 50G speed configuration is applied, peer side sees the link flap.

Resolved In:
PR NumberSynopsisCategory: QFX5K EVO Platform Software related to Chassis
1961751
Minor		Periodic Counters Archive generates periodic CLI execution log entries on Junos OS Evolved QFX platforms
Product-Group=evo		On Junos OS Evolved QFX platforms running affected releases, Periodic Counters Archive starts automatically after system boot and periodically executes CLI commands for counter collection, resulting in repeated CLI execution entries in system logs. Starting with releases containing the change, Periodic Counters Archive does not start automatically after system boot and starts only when the request start system-counter-script command is executed.

Resolved In: evo:25.2X100-EVO evo:26.4R1-EVO junos:26.4R1
1981205
Major		[AQLC] Input power shows 0 value under "show chassis power"
Product-Group=evo		TBD

Resolved In:
PR NumberSynopsisCategory: N/A:sw-telemetry-legacy-library:
1984147
Critical		GNMI OpenConfig telemetry path "/components/component/power-supply/state/" may not give all values when JSON encoding is used.
Product-Group=evo		For GNMI telemetry, the default encoding method is JSON and most customer used encoding method is Protobuf. The current issue in PR 1984147 is an infra bug in JSON encoding while rendering ieeefloat32 binary format. This issue is specific to JSON encoding and in other encodings suhc as Protobug this is working fine. The client software that requests the telemetry data has the choice of selecting the encoding method. The tools like gnmic tool by default uses JSON encoding. If we add "--encoding proto" in the gnmic request then the device will encode the data in Protobuf encoding and the issue will not be seen.

Resolved In:

 

Modification History

First publication 2026-10-20