{"id":"CVE-2026-102178","published":"2026-10-14T17:18:05.610","lastModified":"2026-10-16T17:17:10.237","description":"A Stack-based Buffer Overflow vulnerability in the BGP routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP flowspec peer to cause routing-engine compromise or a routing-daemon denial of service via flowspec route re-advertisement when BGP update-threading is enabled.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-121"],"vendors":[],"products":[],"references":[{"url":"https://supportportal.juniper.net/JSA112187","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A stack-based buffer overflow in Juniper's BGP routing daemon allows a configured BGP flowspec peer to compromise routing engines or cause denial of service when BGP update-threading is enabled. This vulnerability arises from improper bounds checking during flowspec route re-advertisement.","exploitability":"Exploitation requires a configured BGP flowspec peer with access to the network, making it moderately difficult but possible to achieve remote code execution on routing engines.","blast_radius":"If exploited, this vulnerability could compromise multiple routing engines across affected Juniper devices, potentially causing widespread network outages and routing disruptions.","remediation":"Disable BGP update-threading feature immediately until a patch is available, or upgrade to Junos OS version 23.4R1 or later if a fixed version is released.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","network","routing"],"model":"garnet-coder","analyzedAt":"2026-10-15T08:51:10.355Z"}}