CVE-2026-101951

Executive Summary

CVE-2026-101951 is a denial-of-service vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved, classified as an Improper Validation of Consistency within Input (CWE-1288). A network-adjacent, already-configured BGP peer can crash or destabilize the daemon by sending a specifically malformed BGP MCAST-TREE update whose NLRI (Network Layer Reachability Information) is subsequently readvertised by the affected device. With a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), the flaw is high-severity for availability but has no confidentiality or integrity impact and requires no user interaction or privileges beyond an established BGP session.

Technical Analysis

The vulnerability resides in the routing protocol daemon (rpd) of Junos OS and Junos OS Evolved — the process responsible for all routing protocol operation, including BGP. The root cause is an improper validation of consistency within input (CWE-1288). In this class of defect, the implementation accepts an input that violates an internal consistency invariant that the code implicitly assumes to hold, then processes that inconsistent data without revalidating.

Here the inconsistent input is a malformed BGP MCAST-TREE update. MCAST-TREE is a BGP NLRI address family used to carry multicast distribution tree information (tunnel/route attributes describing a multicast tree). The malformed NLRI is not simply parsed and discarded — per the NVD description, the NLRI "is then attempted to be readvertised." This is the critical escalation step: the daemon takes the received, inconsistent attribute/NLRI and propagates it to other BGP peers. The readvertisement path therefore exercises code that the parsing path may not, and it is at that point that the inconsistent state manifests as a denial of service.

Two facts should be emphasized from the description alone, without speculation:

1. The attacker must be a configured BGP peer — i.e., a network-adjacent entity that already holds an established BGP session with the target. This is an authenticated-by-configuration position, not an internet-wide unauthenticated one.
2. The trigger is a specifically malformed MCAST-TREE update, meaning the attacker must deliberately craft the NLRI rather than rely on random corruption.

No function names, code paths, or specific malformed field offsets are disclosed in the provided description. The precise memory-safety or state-handling failure that converts the inconsistent input into a DoS is therefore not publicly documented in the supplied data, and no affected version range has been published.

Exploitation Scenarios

Attack chain, scoped strictly to the disclosed behavior:

1. Reconnaissance / target identification. The attacker must first identify a Juniper device running Junos OS or Junos OS Evolved that will accept a BGP session from them, and that is configured for the relevant address family. Because the attacker must be a "configured BGP peer," this is typically an adjacent network operator, a downstream/upstream peer, or a party that has been granted a session — not an arbitrary internet host attempting to open TCP/179 to an unconfigured target.

2. Trigger of the flaw class. The attacker establishes (or already holds) a BGP session. They then inject a BGP MCAST-TREE update containing a malformed NLRI designed to violate an internal consistency invariant. The vulnerability class is improper validation of consistency within input (CWE-1288): the daemon does not adequately verify that the received NLRI is self-consistent before accepting it as valid routing state.

3. Execution / propagation method. The defining behavior is readvertisement. The device accepts the malformed NLRI into its BGP tables and then attempts to re-advertise that NLRI to its other BGP peers. It is the readvertisement processing — operating on input the daemon has already failed to validate — that produces the denial of service. No public PoC exists; this chain is inferred from the NVD description and the vulnerability class, not from released exploit code.

4. Post-exploitation impact. Based on the CVSS vector, the effect is availability-only: the routing protocol daemon is disrupted, halting or degrading BGP-driven routing on the affected device. There is no impact to confidentiality or integrity (C:N/I:N), the scope is unchanged (S:U — the failure stays within the vulnerable component/device), and no user interaction is required (UI:N).

Impact Assessment

CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yields a base score of 7.5 (High).

• AV:N — exploitable over the network; the BGP session is a network channel.
• AC:L — no unusual conditions beyond an established, configured BGP peering relationship.
• PR:N — no separate authentication credential is needed beyond the configured peer relationship (the peer is trusted by configuration).
• UI:N — fully automated; no operator action required.
• S:U — the impact is confined to the vulnerable Junos component.
• C:N/I:N — no data disclosure or modification.
• A:H — high availability impact; rpd is the routing control plane of the device.

Blast radius: the immediate victim is the targeted Juniper device, whose rpd may fail, restart, or stop processing routing updates. Because the malformed NLRI is readvertised, secondary concern extends to downstream BGP peers that receive the propagated NLRI — though the severity of any secondary effect is not disclosed. For a carrier, service provider, or large enterprise running Junos in its core or edge, an rpd disruption can cascade into BGP session flaps, route churn, and traffic loss for customers behind the device. The constraint that the attacker must be a configured peer limits the threat to trusted-but-compromised or malicious peering relationships.

Detection Guidance

Sigma Rule

title: Juniper Junos rpd Malformed BGP MCAST-TREE Update / NLRI Readvertisement DoS
id: 8b3f6c2a-4d71-4e9a-9c15-0a2e7b6f1d34
status: experimental
description: Detects rpd instability, crashes, or restart events on Junos devices that coincide with BGP MCAST-TREE update processing, consistent with CVE-2026-101951.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-101951
author: Threat Intelligence
date: 2026/01/01
logsource:
  product: juniper
  service: junos
detection:
  selection_daemon:
    process|contains:
      - 'rpd'
  selection_event:
    message|contains|all:
      - 'rpd'
    message|contains:
      - 'MCAST-TREE'
      - 'NLRI'
      - 'core'
      - 'crash'
      - 'restart'
      - 'bgp'
  condition: selection_daemon and selection_event
falsepositives:
  - Legitimate rpd restarts during maintenance or software upgrades
  - Normal BGP update logging without malformed NLRI
level: high
tags:
  - attack.t1499
  - cve.2026-101951

YARA Rule

rule CVE_2026_101951_BGP_MCAST_TREE_MALFORMED_NLRI
{
    meta:
        description = "Heuristic detection of malformed BGP MCAST-TREE NLRI artifacts associated with CVE-2026-101951 readvertisement DoS"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-101951"
        cve = "CVE-2026-101951"
        date = "2026-01-01"

    strings:
        $mcast1 = "MCAST-TREE" ascii wide nocase
        $mcast2 = "MCAST_TREE" ascii wide nocase
        $bgp1   = "readvertis" ascii wide nocase
        $bgp2   = "NLRI" ascii wide nocase

    condition:
        uint16(0) == 0x5C1B or
        (any of ($mcast*) and any of ($bgp*))
}

Note: This rule is heuristic. BGP MCAST-TREE NLRI is encoded in binary BGP path attributes, and no malformed-payload byte pattern has been published for this CVE, so no precise byte signature is provided.

Suricata IDS Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 179 (msg:"CVE-2026-101951 Juniper Junos rpd malformed BGP MCAST-TREE update readvertisement DoS attempt"; flow:established,to_server; content:"|02 14|"; depth:18; content:"MCAST"; nocase; classtype:attempted-dos; sid:2026101951; rev:1; reference:cve,2026-101951; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-101951;)

Note: BGP MCAST-TREE NLRI is carried in binary path attributes; no authoritative byte-level malformed pattern is publicly available. The content:"|02 14|" prefix is a generic BGP UPDATE message-type/header heuristic, and content:"MCAST" is a best-effort keyword match. This rule should be tuned before production use.

Elastic Detection

sequence by process.pid with maxspan=30s
  [process where process.name == "rpd" and event.action == "start"]
  [process where process.name == "rpd" and event.action == "end"]

Detection intent: flag abnormal rpd process termination and restart cycles, which are the observable symptom of a BGP-driven rpd denial of service on a Junos host exporting process telemetry.

Splunk SPL Query

index=juniper sourcetype=juniper:junos*
| search ("rpd" AND ("MCAST-TREE" OR "NLRI" OR "malformed" OR "crash" OR "core" OR "restart"))
| stats count min(_time) as first_seen max(_time) as last_seen by host, process, message
| where count > 1
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| sort - count

Wazuh OSSEC Rule

<group name="juniper,junos,bgp,">
  <rule id="202610" level="12">
    <decoded_as>json</decoded_as>
    <program_name>rpd</program_name>
    <match>MCAST-TREE|NLRI|malformed|readvertised|core|crash|restart</match>
    <description>CVE-2026-101951: Possible Junos rpd denial of service via malformed BGP MCAST-TREE update / NLRI readvertisement</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>cve_2026_101951,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor fix, workaround, or affected version range was present in any tracked source at the time of writing.

1. Immediate mitigations

   • Restrict BGP peering to explicitly trusted, configured peers and verify that no unnecessary BGP sessions (particularly for multicast address families) are enabled.
   • Where MCAST-TREE NLRI is not operationally required, disable the relevant address family on BGP sessions to remove the attack surface.
   • Apply unicast RPF / BGP session access control and TCP/179 filtering so that only intended peers can reach the control plane.
   • Enable routing-protocol authentication (TCP-MD5 / BGP session protection) to prevent unauthorized or hijacked peering sessions.
   • Monitor rpd stability closely; deploy logging and alerting (see Detection Guidance) to catch early crash/restart indications.

2. Patch / upgrade steps

   • No patch is currently available from tracked sources. Monitor the Juniper Networks security advisories page for a Junos OS / Junos OS Evolved update addressing CVE-2026-101951.
   • Once a fixed release is published, upgrade affected devices to the vendor-designated fixed version for their Junos train and validate that affected BGP sessions are stable.
   • Until a patch exists, treat affected multicast-BGP-enabled Junos devices as high-priority for compensating controls and peer monitoring.

3. Long-term hardening

   • Enforce strict input validation expectations at the peering boundary by limiting which address families and NLRI types are accepted from each peer.
   • Adopt defense-in-depth for the routing control plane: control-plane policing, out-of-band management, and BGP route filtering/prefix limits.
   • Maintain an asset inventory of Junos OS and Junos OS Evolved devices to enable rapid patching when the vendor advisory is released.

References

• NVD — CVE-2026-101951: https://nvd.nist.gov/vuln/detail/CVE-2026-101951
• CWE-1288 — Improper Validation of Consistency within Input: https://cwe.mitre.org/data/definitions/1288.html
• Juniper Networks Security Advisories (monitor for a fix): https://supportportal.juniper.net/s/global-search/%40uri#q=security%20advisories
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-101951 not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS (CVE-2026-101951 not yet scored): https://www.first.org/epss/

No public proof-of-concept, exploit code, Nuclei template, or in-the-wild exploitation evidence was identified for CVE-2026-101951 in the provided data. The CVE is not listed in CISA KEV, and no threat-actor campaign is associated with it at this time.