CVE-2026-102024

Junos OS and Junos OS Evolved: An attacker causes a routing daemon crash when BGP extended-nexthop-tunnel is used

State: Published
Severity: 8.7 High
Published: Oct 14, 2026
Updated: Oct 16, 2026
Reserved: Sep 28, 2026

Description

An Integer Overflow or Wraparound vulnerability in the routing daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated BGP peer to cause a denial of service via BGP route updates when extended-nexthop-tunnel is enabled.

Scores

CVSS	Score	Vector	Source
4.0	8.7 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M	juniper
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	juniper

Weaknesses

CWE-190 Integer Overflow or Wraparound

Affected Products

Product	Versions
Junos OSJuniper Networks	before 23.2R2-S7.7Affected 23.4 to before 23.4R2-S8.13Affected 24.2 to before 24.2R2-S5.5Affected 24.4 to before 24.4R2-S5Affected 25.2 to before 25.2R2-S2Affected 25.4 to before 25.4R1-S3Affected 26.2 to before 26.2R1-S2Affected
Junos OS EvolvedJuniper Networks	before 23.2R2-S7.7-EVOAffected 23.4 to before 23.4R2-S8.11-EVOAffected 24.2 to before 24.2R2-S5.6-EVOAffected 24.4 to before 24.4R2-S5-EVOAffected 25.2 to before 25.2R2-S2-EVOAffected 25.4 to before 25.4R1-S3-EVOAffected 26.2 to before 26.2R1-S2-EVOAffected 23.4X100Affected 25.2X100 to before 25.2X100-D35-EVOAffected 25.4X300 to before 25.4X300-D40-EVOAffected

References

https://supportportal.juniper.net/JSA112187vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.