CVE-2026-101990

Executive Summary

CVE-2026-101990 is a stack-based buffer overflow (CWE-121) in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. The flaw is reachable by a remote, configured BGP peer that sends a flow-spec update which the device selects for re-advertisement, driving rpd to crash — and on Junos OS, potentially enabling remote code execution. With a CVSS 3.1 base score of 9.8 and unpatched status across all tracked sources, this is a critical, network-reachable fault affecting internet- and WAN-exposed routing infrastructure.

Technical Analysis

The vulnerability resides in the routing protocol daemon (rpd), the process responsible for running Junos routing protocols including BGP, and it manifests as a stack-based buffer overflow (CWE-121). The NVD description states the trigger is a flow-spec update delivered by an already-configured BGP peer that the device selects for re-advertisement. Flow-spec (RFC 5575, "Dissemination of Flow Specification Rules") is a BGP NLRI type that lets a peer distribute traffic-filtering rules (flow routes) throughout an autonomous system. When rpd accepts such an update and re-advertises it to other peers, the contents of that update are processed along a code path that copies data onto a fixed-size stack buffer without adequate bounds validation. That overwrite is the CWE-121 condition.

Two characteristics of this issue drive its severity rating:

• Reachable by an authenticated routing peer over the network (AV:N). The attack vector is the BGP session itself, so no local access or user interaction is required (PR:N/UI:N under the NVD vector). This inflates score relative to typical client-side memory corruption bugs.
• Exposure varies by platform. The same defect produces a crash of rpd on both Junos OS and Junos OS Evolved, but the description explicitly notes that remote code execution is possible on Junos OS. Because rpd is a long-lived privileged process, corruption of its stack can, on the affected platform, be escalated beyond the guaranteed crash into arbitrary code execution in the routing daemon's security context.

No exploitation primitives beyond the vulnerability class are documented in the available data: the description does not disclose the specific buffer, the function that performs the copy, or the precise length/boundary relationship that overflows. Those implementation details are not available and should not be assumed. What is established is the vulnerability class (stack-based buffer overflow), the component (rpd), the protocol path (BGP flow-spec update selected for re-advertisement), and the concrete impacts (rpd crash on both platforms; potential RCE on Junos OS).

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template is available for this CVE; the chain below is inferred strictly from the vulnerability class and the NVD description. No specific function names, endpoints, or API parameters beyond those in the description are asserted.

1. Reconnaissance / target identification. An adversary identifies routing infrastructure that is both reachable for a BGP session and willing to accept the attacker as a peer — for example, a device that has the attacker configured as a BGP neighbor with flow-spec address-family capability negotiated. Exposure is signaled by open BGP service (TCP/179) and by deployments that exchange flow-spec routes for DDoS scrubbing or traffic-filtering distribution. Junos devices managing such filtering across a fabric are the highest-value targets.

2. Triggering the flaw class. The attacker (as a configured BGP peer) crafts and sends a flow-spec update — a BGP NLRI carrying flow-specification rules — sized or structured such that when rpd processes it for re-advertisement, an unbounded copy into a fixed-size stack buffer overruns it. The decisive precondition noted in the description is that the update is selected for re-advertisement: the malicious route must be chosen by the local policy for propagation, which places execution on the vulnerable processing path. This is a crafted-protocol-message attack against a memory-unsafe parser/re-writer.

3. Payload / execution method (class level). For the crash case, the crafted update drives a stack overwrite that corrupts control state and terminates the rpd process. For the RCE case on Junos OS, the same overflow class would be leveraged to redirect control flow within rpd — but the specific overwrite offsets, mitigations, and gadget details are not provided in the available data and cannot be enumerated here without fabricating them. Treat the RCE pathway as platform-dependent and conditionally reachable, not as a turnkey exploit.

4. Post-exploitation impact. At minimum, an rpd crash disrupts routing and forces the daemon to restart, causing a denial-of-service window for all routing protocols rpd services — including the BGP sessions that depend on it — and potentially destabilizing route propagation across the affected network. If RCE on Junos OS is achieved, an attacker gains code execution in a highly privileged routing process, from which they could manipulate routing, tamper with forwarding behavior, or pivot toward control-plane compromise. Whether RCE is reliably reachable in practice is undocumented.

Impact Assessment

The CVSS 3.1 vector — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — rates the impact as maximum across confidentiality, integrity, and availability, with low attack complexity, no privileges required, and no user interaction. The only reduction relative to a purely physical attack is that a session with a configured BGP peer is necessary; once that neighbor relationship exists, a single crafted flow-spec update is sufficient.

• Availability (High): An rpd crash directly degrades the routing control plane. Loss of rpd can interrupt BGP peering, flow-spec filter distribution, and dependent routing functions, propagating DoS well beyond a single device in a fabric that distributes flow-spec routes.
• Confidentiality / Integrity (High): These reflect the potential for remote code execution on Junos OS, where an attacker who gains control of rpd could read or alter routing state and configuration.
• Blast radius: Bounded by how many devices in the routing domain process and re-advertise the malicious flow-spec route — a single core router, or an entire AS's worth of flow-spec consumers depending on topology. Flow-spec routes are explicitly designed to propagate widely, which makes re-advertisement an amplifier rather than a constraint.

Given the unpatched status, the absence of a public PoC, and the fact that Juniper routing platforms sit at the core of many enterprise and carrier networks, the practical priority is high even though no in-the-wild exploitation has been observed. No EPSS score is available (not yet scored by FIRST.org), and the CVE is not listed in CISA KEV.

Detection Guidance

Detection must operate at two layers: network visibility into BGP flow-spec traffic (or device telemetry) and host/device logging of rpd behavior. The rules below are behavioral templates keyed to the vulnerability class and the described trigger; they do not assume any internal function names.

Sigma Rule

title: Junos rpd Crash or Restart Following BGP Flow-Spec Update (CVE-2026-101990)
id: 8f1c9a42-3d5b-4e7a-9c10-cve2026101990
status: experimental
description: Detects rpd process crash/restart on Juniper Junos OS/EVOLVED implying potential exploitation of the rpd stack-based buffer overflow via a re-advertised BGP flow-spec update.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-101990
author: valtersit.com
date: 2026/01/01
logsource:
  product: juniper
  service: junos
detection:
  selection_process:
    - 'process.name|contains: "rpd"'
    - 'message|contains: "rpd"'
  selection_event:
    - 'message|contains: "core dump"'
    - 'message|contains: "restart"'
    - 'message|contains: "segmentation fault"'
    - 'message|contains: "abnormal termination"'
  selection_bgp:
    - 'message|contains: "flow-spec"'
    - 'message|contains: "flow spec"'
    - 'message|contains: "bgp_flow"'
  condition: selection_process and selection_event and selection_bgp
falsepositives:
  - Legitimate rpd restarts unrelated to flow-spec
  - Routine BGP session resets
level: high

YARA Rule

rule CVE_2026_101990_Junos_rpd_FlowSpec
{
    meta:
        description = "Heuristic detection of artifacts referencing the Junos rpd stack-based buffer overflow via BGP flow-spec (CVE-2026-101990)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-101990"
        date = "2026-01-01"
        severity = "critical"
    strings:
        $rpd      = "rpd" nocase
        $flow     = "flow-spec" nocase
        $flow2    = "flowspec" nocase
        $junos    = "junos" nocase
        $bgp      = "bgp" nocase
        $crash    = "segmentation fault" nocase
        $reradv   = "re-advertis" nocase
    condition:
        filesize < 10MB and
        (uint16(0) == 0x5A4D or uint32(0) == 0x464C457F or true) and
        $junos and $bgp and ($flow or $flow2) and ($rpd or $reradv)
}

Suricata IDS Rule

alert bgp any any -> any 179 (msg:"CVE-2026-101990 Juniper Junos rpd BGP flow-spec overflow attempt (re-advertisement)"; flow:established; content:"|09 00 00 00|"; depth:5; classtype:attempted-admin; reference:cve,2026-101990; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-101990; metadata:affected_product Junos_OS, deployment Perimeter, confidence Low; sid:2026101990; rev:1;)

alert bgp any 179 -> any any (msg:"CVE-2026-101990 Juniper Junos rpd flow-spec NLRI anomaly detected"; flow:established,from_server; content:"|09 00 00 00|"; depth:5; classtype:protocol-command-decode; reference:cve,2026-101990; sid:2026101991; rev:1;)

Note: BGP/flow-spec uses a variable NLRI structure; adapt the detection to your parser. The rule anchors on the BGP message header (0x09 = UPDATE) and is a low-confidence template given no PoC reveals the exact offending encoding.

Elastic Detection

sequence by host.name with maxspan=30s
  [ process where process.name == "rpd" and
      event.type in ("start", "process_started") ]
  [ process where process.name == "rpd" and
      event.category == "process" and
      event.action in ("crash", "terminated", "abnormal_exit") ]

This EQL sequence flags rpd termination/crash within 30 seconds of its start — indicating an unexplained daemon restart consistent with exploitation-induced corruption.

Splunk SPL Query

index=network sourcetype=juniper:junos:syslog
(
  (process=*rpd* OR "rpd") AND
  ("core dump" OR "restart" OR "segmentation fault" OR "abnormal termination" OR "SIGSEGV")
)
OR
("flow-spec" OR "flowspec" AND "BGP" AND ("update" OR "advertis"))
| stats count min(_time) as first_seen max(_time) as last_seen
        values(host) as affected_devices
        values(message) as example_messages
  by host
| where count >= 1
| sort - count

Wazuh OSSEC Rule

<group name="juniper,junos,cve-2026-101990,">
  <rule id="1019900" level="12">
    <decoded_as>junos</decoded_as>
    <match>rpd</match>
    <regex>(core dump|restart|segmentation fault|abnormal termination|SIGSEGV)</regex>
    <description>CVE-2026-101990: Junos rpd crashed/restarted - possible BGP flow-spec buffer overflow exploitation</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>availability,routing,exploit_attempt,</group>
  </rule>

  <rule id="1019901" level="12">
    <decoded_as>junos</decoded_as>
    <regex>(flow-spec|flowspec)</regex>
    <match>BGP</match>
    <description>CVE-2026-101990: BGP flow-spec update activity correlated with rpd fault</description>
    <group>bgp,flow-spec,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4 — UNPATCHED. No vendor fix, advisory, or version-range data is available from any tracked source. Assume all Junos OS and Junos OS Evolved deployments that process BGP flow-spec and can select such routes for re-advertisement are potentially affected until Juniper publishes guidance.

1) Immediate mitigations (reduce reachability of the vulnerable code path):

• Restrict BGP peering. Only accept BGP sessions from explicitly trusted, configured peers. The description confirms a configured BGP peer is required — eliminate unneeded or stale neighbors.
• Disable flow-spec where it is not required. If the RFC 5575 flow-spec address family is not operationally needed, do not negotiate it with peers. This removes the vulnerable processing path entirely.
• Constrain re-advertisement. Apply inbound and outbound routing policy so that flow-spec routes are not selected for re-advertisement unless strictly necessary; the vulnerability requires the crafted update to be selected for re-advertisement. Tighten export policy on flow-spec NLRI.
• Filter and authenticate. Apply RPKI/route-origin validation and TCP MD5 / BGPsec-style session protection where supported, and monitor for anomalous or malformed flow-spec NLRI from peers.
• Resilience. Ensure rpd supervisory restart behavior and graceful-restart are configured so a crash recovers routing without collateral instability; segment protocol and management planes.

2) Patch / upgrade steps:

• Monitor the Juniper Networks advisory portal and the NVD page for CVE-2026-101990 for an official fixed Junos OS and Junos OS Evolved release. No fixed version is currently identified.
• When a vendor release is published, test in a lab replica of your control plane, then schedule maintenance-window upgrades prioritizing internet/WAN-facing route reflectors, flow-spec consumers, and core routers.
• Until then, treat the devices as exposed and compensate with the network-level mitigations above.

3) Long-term hardening:

• Maintain a minimal, auditable set of BGP neighbors with strict prefix and address-family policy.
• Adopt route-flap dampening and flow-spec route limits to bound abnormal NLRI.
• Integrate device telemetry (rpd restart events, core dumps) into the SOC pipeline with the detections above and alert on unexplained daemon restarts.
• Establish a vendor-advisory monitoring workflow so this and future Junos CVEs are triaged the day a patch lands.

References

• NVD — CVE-2026-101990: https://nvd.nist.gov/vuln/detail/CVE-2026-101990
• MITRE CWE-121 — Stack-based Buffer Overflow: https://cwe.mitre.org/data/definitions/121.html
• Juniper Networks Security Advisories (vendor portal — monitor for CVE-2026-101990): https://supportportal.juniper.net/s/global-search/%40uri
• RFC 5575 — Dissemination of Flow Specification Rules (background on the BGP flow-spec NLRI involved): https://www.rfc-editor.org/rfc/rfc5575
• CISA Known Exploited Vulnerabilities Catalog (check for future addition — currently not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST.org EPSS (currently not scored for this CVE): https://www.first.org/epss/

No threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-101990 in the available data. No public proof-of-concept, exploit code, or Nuclei template exists as of this report; all exploit characterization is inferred from the vulnerability class and the NVD description.