CVE-2026-102065

Executive Summary

CVE-2026-102065 is an improper input validation vulnerability (CWE-1284) in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. A remote, unauthenticated BGP peer can crash the rpd process by sending a malformed BGP-signaled SRv6 service route when SRv6 dynamic tunnels are enabled on the target device. Successful exploitation results in a denial-of-service condition affecting routing and forwarding plane stability, though it does not impact confidentiality or integrity. With a CVSS base score of 7.5 and no publicly available patch, proof-of-concept, or exploit code, this vulnerability represents a significant availability risk to Juniper-based network infrastructure that has SRv6 dynamic tunnels enabled.

Technical Analysis

The vulnerability resides in the routing protocol daemon (rpd) of Junos OS and Junos OS Evolved. Per the NVD description, the root cause is an "Improper Validation of Specified Quantity in Input" (CWE-1284). This weakness class occurs when software does not correctly validate the size, length, or count fields within an input structure, leading to resource exhaustion, buffer over-reads, or memory corruption.

In this specific case, the attack is delivered via the BGP protocol. A remote, unauthenticated BGP peer can send a malformed BGP-signaled SRv6 service route. The vulnerability is only reachable when SRv6 dynamic tunnels are enabled on the affected device. The malformed route causes the rpd process to crash, resulting in a denial-of-service condition. Because the attack vector is the BGP control plane, no authentication, user interaction, or local access is required — the attacker only needs to establish a BGP peering session or inject a route into an established session.

The specific field within the SRv6 service route that is improperly validated is not disclosed in the available data. Consequently, the exact malformed quantity (e.g., segment list length, TLV length, or attribute length) that triggers the crash cannot be confirmed from the NVD description alone. What is known is that the flaw is in the parsing/validation path for BGP-signaled SRv6 service routes within rpd, and that the crash is a consequence of the daemon processing an input quantity that fails validation.

The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects a remotely exploitable, low-complexity attack with no privileges required and no user interaction, resulting in a high availability impact only. The scope is unchanged, meaning the impact is confined to the rpd process and the routing functionality it manages. No confidentiality or integrity impact is indicated.

Exploitation Scenarios

No public proof-of-concept or exploit code is available. The attack chain below is inferred from the vulnerability class (improper input validation in a BGP route parser) and the NVD description, without inventing specific implementation details.

1. Reconnaissance/Target Identification: The attacker identifies a Juniper Networks device running Junos OS or Junos OS Evolved that is configured with SRv6 dynamic tunnels enabled and participates in BGP. This can be inferred from network scanning (e.g., open TCP port 179), routing advertisements, or prior knowledge of the target network architecture.

2. Triggering the Flaw: The attacker establishes or leverages a BGP peering session with the target device. Using a crafted BGP UPDATE message, the attacker advertises an SRv6 service route containing a malformed quantity field (e.g., an invalid length or count value) within the SRv6 service route signaling. Because the rpd process does not properly validate this specified quantity, it processes the malformed input in a way that leads to a crash.

3. Payload/Execution Method: The payload is a malformed BGP-signaled SRv6 service route delivered within a standard BGP UPDATE. The attacker does not need to exploit memory corruption or execute code; the mere processing of the malformed route by the vulnerable rpd code path causes the daemon to terminate. The specific malformed value is not disclosed in available data.

4. Post-Exploitation Impact: The rpd process crashes, disrupting BGP routing and potentially causing routing instability, session resets, and loss of reachability for networks dependent on the affected device. Depending on the platform's high-availability configuration, the crash may trigger a failover or a restart of the routing process. Repeated exploitation could sustain a denial-of-service condition. No data exfiltration or lateral movement is enabled by this vulnerability itself.

Impact Assessment

The business impact is primarily availability-related. Affected systems are Juniper Networks devices running Junos OS or Junos OS Evolved with SRv6 dynamic tunnels enabled and active BGP peering. The blast radius includes any network segment whose routing depends on the crashed rpd process, potentially causing widespread service outages, routing black holes, or degradation of network performance. The CVSS subscores reflect this: Availability impact is High (A:H), while Confidentiality (C:N) and Integrity (I:N) impacts are None. The attack is network-accessible (AV:N), low complexity (AC:L), requires no privileges (PR:N) and no user interaction (UI:N). The scope is unchanged (S:U), meaning the impact is contained within the routing daemon and its dependent routing functions. No CISA KEV listing or EPSS score is available, but the lack of a patch increases the operational risk until mitigations are applied.

Detection Guidance

Sigma Rule

title: Juniper Junos rpd Crash via Malformed BGP SRv6 Service Route
id: 3f9c2a1e-8b7d-4f6a-9c0e-1d2e3f4a5b6c
status: experimental
description: Detects a crash of the Juniper routing protocol daemon (rpd) potentially caused by a malformed BGP-signaled SRv6 service route.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102065
author: Threat Intelligence
date: 2026-01-01
logsource:
  product: juniper
  service: junos
detection:
  selection:
    - message|contains: 'rpd'
      message|contains: 'SRv6'
      message|contains: 'malformed'
    - message|contains: 'rpd'
      message|contains: 'BGP'
      message|contains: 'service route'
      message|contains: 'invalid'
  condition: selection
falsepositives:
  - Legitimate BGP updates with SRv6 service routes that are correctly formed
  - Administrative changes to SRv6 dynamic tunnel configuration
level: high

YARA Rule

rule CVE_2026_102065_Juniper_rpd_BGP_SRv6_Crash
{
    meta:
        description = "Detects malformed BGP-signaled SRv6 service route patterns that may trigger rpd crash in Juniper Junos (CVE-2026-102065)"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102065"
        severity = "high"

    strings:
        $srv6_1 = "SRv6" ascii wide nocase
        $srv6_2 = "srv6" ascii wide
        $bgp_srv6 = "BGP" ascii wide nocase
        $malformed = "malformed" ascii wide nocase

    condition:
        (uint16(0) == 0xFFFF or true) and
        any of ($srv6_*) and $bgp_srv6
}

Note: This YARA rule is a heuristic placeholder due to the absence of specific technical details regarding the malformed SRv6 service route structure. It is intended for scanning configuration or log files, not live network traffic.

Suricata IDS Rule

alert tcp any any -> any 179 (msg:"CVE-2026-102065 Juniper Junos rpd BGP SRv6 service route malformed quantity attempt"; flow:established,to_server; content:"|FF FF FF FF|"; depth:4; content:"|02|"; within:19; byte_test:1,>,20,0,relative; reference:cve,2026-102065; classtype:attempted-dos; sid:2026102065; rev:1;)

Note: This rule uses generic BGP header matching (marker and type) and a placeholder byte test. Because the exact malformed SRv6 service route structure is not disclosed, the rule may generate false positives and should be tuned upon further vendor detail.

Elastic Detection

process where event.type == "start" and
  process.name == "rpd" and
  process.args : "*SRv6*" and
  process.args : "*BGP*"

Note: This EQL rule targets process start events for rpd with SRv6 and BGP-related arguments, which may indicate the daemon restarting after a crash. It is a heuristic detection due to limited technical detail.

Splunk SPL Query

index=juniper sourcetype=junos:syslog
| search "rpd" "SRv6" ("malformed" OR "invalid" OR "crash" OR "core dump")
| stats count by host, message
| where count > 0

This query searches Junos syslog for rpd crashes or malformed SRv6-related messages that may indicate exploitation attempts.

Wazuh OSSEC Rule

<group name="juniper,">
  <rule id="100065" level="12">
    <decoded_as>syslog</decoded_as>
    <match>rpd</match>
    <regex>SRv6.*(malformed|invalid|crash)</regex>
    <description>CVE-2026-102065: Possible Juniper rpd crash via malformed BGP SRv6 service route</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations:

   • If SRv6 dynamic tunnels are not operationally required, disable them to remove the vulnerable code path from the attack surface.
   • Restrict BGP peering to trusted, authenticated peers using BGP MD5/TCP-AO authentication and prefix limits where feasible.
   • Apply inbound BGP route filters to reject unexpected or malformed SRv6 service routes from untrusted peers.
   • Monitor rpd process stability and enable core dumps for forensic analysis if a crash occurs.

2. Patch/Upgrade Steps:

   • No patch is currently available from Juniper Networks according to tracked sources. Monitor the Juniper Security Advisories page for an official fix and apply it as soon as it is released.
   • Until a patch is available, consider deploying vendor-provided workarounds or hotfixes if Juniper publishes any.

3. Long-Term Hardening:

   • Adopt a strict BGP security posture: route filtering, maximum prefix limits, and authentication for all BGP sessions.
   • Segment SRv6-enabled infrastructure and limit BGP peering to required peers only.
   • Implement continuous monitoring for rpd crashes and unexpected BGP route advertisements.
   • Maintain an inventory of Junos OS and Junos OS Evolved devices with SRv6 enabled and prioritize them for patching once a fix is available.

References

• NVD — CVE-2026-102065: https://nvd.nist.gov/vuln/detail/CVE-2026-102065
• Juniper Networks Security Advisories: https://supportportal.juniper.net/s/global-search/%40uri#q=security%20advisories
• CWE-1284: Improper Validation of Specified Quantity in Input — https://cwe.mitre.org/data/definitions/1284.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities Catalog (not listed as of report date): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• No known threat actor campaigns or exploit-in-the-wild evidence is available for this CVE at the time of writing.