{"id":"CVE-2026-101990","published":"2026-10-14T17:17:51.587","lastModified":"2026-10-16T15:17:00.060","description":"A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote configured BGP peer to cause an rpd crash, or on Junos OS remote code-execution, via sending a flow-spec update which is selected for re-advertisement.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-121"],"vendors":[],"products":[],"references":[{"url":"https://supportportal.juniper.net/JSA112187","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A stack-based buffer overflow in Juniper's routing protocol daemon (rpd) allows remote attackers to either crash the service or achieve remote code execution on Junos OS systems by sending specially crafted flow-spec updates. This vulnerability is particularly dangerous because it can be exploited remotely without authentication and affects the core routing functionality.","exploitability":"Exploitation requires a configured BGP peer to send a malicious flow-spec update, making it moderately difficult to achieve but possible with minimal prerequisites.","blast_radius":"The impact could be severe across networks relying on Junos OS for routing, potentially causing widespread service outages or unauthorized access to critical network infrastructure.","remediation":"Upgrade to Junos OS 23.4R3 or later immediately, as this version contains the necessary patches for CVE-2026-101990.","detection":"Monitor for rpd process crashes in system logs and check for abnormal BGP flow-spec update traffic patterns in network monitoring tools.","tags":["rce","network","routing","remote-exploit"],"model":"garnet-coder","analyzedAt":"2026-10-15T08:50:42.010Z"}}