CVE-2026-102178

Executive Summary

CVE-2026-102178 is a stack-based buffer overflow (CWE-121) in the BGP routing daemon of Juniper Networks Junos OS and Junos OS Evolved. A configured BGP flowspec peer can trigger the flaw through flowspec route re-advertisement when BGP update-threading is enabled, leading to routing-engine compromise or a routing-daemon denial of service. Rated CVSS 9.8 (Critical), this vulnerability is currently unpatched with no public exploit, PoC, or Nuclei template available — but its network-reachable, low-complexity, no-privilege attack profile makes it a high-priority exposure for any service provider, data-center, or enterprise edge running Junos with BGP flowspec and update-threading active.

Technical Analysis

The vulnerability resides in the BGP routing daemon (the process responsible for BGP session management, route selection, and NLRI processing) on Juniper Junos OS and Junos OS Evolved. The root cause class is a stack-based buffer overflow (CWE-121): a fixed-size stack buffer is populated with data whose length is not adequately validated against the buffer capacity, allowing an overflow of adjacent stack memory.

The specific trigger path described is flowspec route re-advertisement by a configured BGP flowspec peer. BGP flowspec (RFC 5575 / RFC 8955) is an address-family extension that distributes traffic-filtering rules — flow specifications consisting of match components and associated actions — via BGP UPDATE messages. Flow specification NLRI is variable-length and composed of multiple typed components (destination/source prefix, protocol, port, fragment, TCP flags, packet length, DSCP, etc.), each encoded as a type-length-value structure. This variable-length, TLV-structured encoding is a natural attack surface for buffer-overflow conditions when a decoder copies component data into a fixed-size stack buffer without rigorous bounds checking.

The phrase "route re-advertisement" is significant: the overflow is reachable not only on initial receipt of a flowspec route but when a flowspec route is re-advertised — i.e., processed again as it is propagated to other peers. This implies the flawed codepath is exercised during the re-advertisement/update-generation logic, potentially amplifying reachability and making the trigger stateful rather than a single-shot malformed-message condition.

The vulnerability is further gated by BGP update-threading being enabled. Junos supports threading of BGP update processing, and the stack layout / concurrency characteristics of the threaded update path are where the overflow manifests. Where routing-engine (RE) compromise occurs, the attacker gains code execution in the context of the routing daemon with routing-engine privileges — a severe outcome on a device that anchors network routing. Where full compromise is not achieved, the same trigger yields a routing-daemon crash (denial of service), which alone can cause BGP session resets and route churn.

Attack surface summary: remotely reachable over the BGP transport (TCP/179) from any peer that has been configured as a flowspec peer — a trusted-but-adversary-controllable position. No authentication, user interaction, or prior local access is required beyond being a configured peer (the CVSS vector reflects AV:N/AC:L/PR:N/UI:N). Precision of the claimed exploitability: the CVSS vector and NVD description support remote network exploitation; specific affected Junos version ranges are not disclosed in the available data. Insufficient technical detail is available to name the exact parser routine, buffer identifier, or overflow arithmetic; the analysis above is scoped to the documented mechanism (flowspec re-advertisement + update-threading → stack buffer overflow).

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is available for this CVE. The attack chain below is inferred from the vulnerability class (stack-based buffer overflow in a network protocol parser) and the explicit mechanism in the NVD description; no specific function names, filenames, or parameters are fabricated.

1. Reconnaissance / target identification. The adversary identifies a Juniper device running Junos OS or Junos OS Evolved that (a) has BGP flowspec configured and (b) has BGP update-threading enabled. Reachability requires the attacker to be, or to control, a configured BGP flowspec peer of the target — commonly a customer edge, a partner AS, a route-reflector client, or any peer with flowspec address-family negotiated. External discovery can be aided by identifying internet-exposed BGP speakers, though legitimate peering relationships are the realistic vector; the trust relationship is the access primitive, not anonymity.

2. Triggering the flaw class. As a configured flowspec peer, the attacker advertises crafted flowspec NLRI. The variable-length flow-spec components are delivered in BGP UPDATE messages; when the target routing daemon processes the flowspec route and re-advertises it (propagating it toward other peers), the re-advertisement codepath copies flowspec data into a fixed-size stack buffer without sufficient bounds enforcement. A crafted flowspec route whose component data exceeds the destination buffer capacity overwrites adjacent stack memory. Because the trigger is tied to re-advertisement under update-threading, the attacker may need flowspec routes that the device will accept and re-propagate, and may benefit from repeated or sustained advertisement to reliably hit the threaded codepath.

3. Payload / execution method (class level). As a classic stack-based buffer overflow, the canonical outcome is corruption of the return address or adjacent stack-resident control data, redirecting execution within the routing daemon's process context. Achieving reliable control-flow hijack on modern Junos (with OS/compiler-level exploit mitigations potentially in play, details not disclosed) may be difficult; the description explicitly allows either routing-engine compromise (successful code execution) or routing-daemon denial of service (crash), indicating that a lower-skill trigger can still achieve DoS even without a reliable control-flow payload.

4. Post-exploitation impact. On successful compromise, the attacker operates in the routing daemon on the routing engine with high confidentiality, integrity, and availability impact (per the CVSS vector C:H/I:H/A:H). Code execution in the routing daemon is a foothold on the control plane: it enables manipulation of routing state, inspection or alteration of control-plane data, and potential lateral movement toward routing-engine-level access. On the DoS path, the crash resets BGP sessions, triggers route reconvergence, and can cause widespread service disruption across the affected routing domain.

Note: the specific byte sequences, overflow offsets, and any exploit primitives are unknown; no public exploit exists as of this report.

Impact Assessment

• CVSS: 9.8 (Critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
• Attack Vector (AV:N): Exploitable remotely over the network via the BGP transport — no physical or adjacent access required.
• Attack Complexity (AC:L): No special conditions beyond the configuration state (flowspec peer + update-threading); the attack is considered straightforward for a positioned peer.
• Privileges Required (PR:N): No prior privileges on the device; the "privilege" is the peer relationship, which the vector treats as unauthenticated network reach.
• User Interaction (UI:N): No operator action required to trigger.
• Scope (S:U): Impact is contained to the routing daemon / routing engine component; no explicit scope change is scored.
• Confidentiality / Integrity / Availability (C:H/I:H/A:H): Full high impact across all three — consistent with routing-engine compromise (control-plane code execution) and with severe availability loss from daemon crash.

Blast radius. Junos OS powers service-provider edge/PE routers, data-center fabrics, and enterprise WAN edge — devices that are core to network operation. Compromise of the routing daemon on such a device can affect the entire routing domain the device serves, not just the device itself. DoS on a BGP speaker causes session resets and route reconvergence for all peers, with cascading effects on traffic paths. Because the trigger requires only a configured flowspec peer, any organization that peers with semi-trusted or adversarial parties (transit customers, multi-tenant environments, IXP peers) has meaningful exposure. Business impact includes service outages, potential traffic interception/redirection if running code is achieved, and regulatory/operational consequences of control-plane compromise.

Detection Guidance

Detection focuses on anomalous flowspec activity from peers, BGP daemon instability, and crashes within the routing daemon. Because the exact malformed flowspec encoding is unknown, network detections are necessarily heuristic (malformed/unusual flowspec NLRI, re-advertisement bursts) rather than signature-precise.

Sigma Rule

title: Suspicious Junos BGP Daemon Crash or Restart (CVE-2026-102178)
id: 3b6f1c2a-9d4e-4a77-8c11-2f0b5c7e9a01
status: experimental
description: Detects routing-daemon (BGP) crash/restart events on Junos devices that may indicate exploitation of a BGP flowspec stack buffer overflow.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102178
author: valtersit.com
date: 2026/01/01
logsource:
  product: juniper
  service: junos
detection:
  selection_crash:
    message|contains:
      - 'rpd'
      - 'BGP'
  selection_event:
    message|contains:
      - 'core dumped'
      - 'process restart'
      - 'abnormal termination'
      - 'panic'
  selection_flowspec:
    message|contains:
      - 'flowspec'
      - 'flow-spec'
  condition: selection_crash and selection_event
  # Correlate with flowspec peer activity to raise confidence
falsepositives:
  - Legitimate daemon restarts during maintenance or upgrades
level: high

YARA Rule

rule CVE_2026_102178_Junos_BGP_Flowspec_BOF_Marker
{
    meta:
        author = "valtersit.com"
        description = "Heuristic match for Junos core dumps / crash artifacts referencing the BGP routing daemon and flowspec"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102178"
        date = "2026-01-01"
        severity = "high"

    strings:
        $rpd    = "rpd"        ascii wide nocase
        $bgp    = "bgp"        ascii wide nocase
        $fs     = "flowspec"   ascii wide nocase
        $fsh    = "flow-spec"  ascii wide nocase
        $crash  = "core dumped"     ascii wide nocase
        $abort  = "abnormal termination" ascii wide nocase
        $stk    = "stack"      ascii wide nocase

    condition:
        uint32(0) == 0x464c457f or   // ELF (core dump / binary)
        any of ($crash, $abort)
        and ($rpd and $bgp)
        and any of ($fs, $fsh)
}

Suricata IDS Rule

alert tcp any 179 -> any 179 ( \
  msg:"CVE-2026-102178 Possible Juniper Junos BGP Flowspec Stack Buffer Overflow Re-advertisement"; \
  flow:established,to_server; \
  content:"|FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF|"; depth:16; \
  content:"|02|"; within:3; \
  byte_test:1,>,3,0,relative; \
  threshold:type limit, track by_src, count 20, seconds 60; \
  reference:cve,CVE-2026-102178; \
  reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-102178; \
  classtype:attempted-admin; \
  sid:2026102178; rev:1; )

Note: because the exact flowspec NLRI encoding that overflows is not public, this rule uses BGP UPDATE-type and length heuristics plus a rate threshold to surface anomalous flowspec-heavy update patterns from a single peer. Tune byte_test and thresholds against baseline BGP traffic.

Elastic Detection

// Detect Junos BGP routing-daemon crash/restart events indicating possible exploitation
event.category: "process" and host.os.type: "network" and
process.name: ("rpd" or "routing") and
event.action: ("crashed" or "terminated" or "restarted") and
(message: *flowspec* or message: *flow-spec* or message: *BGP*)

sequence by host.name
  [ event.category: "network" and network.transport: "tcp" and destination.port: 179 ]
  [ event.action: "crashed" and process.name: "rpd" ]

Splunk SPL Query

index=juniper sourcetype=junos:log (rpd OR BGP OR flowspec OR "flow-spec")
| search ("core dumped" OR "abnormal termination" OR "process restart" OR "panic" OR "scheduler O(%")
| stats count min(_time) as first_seen max(_time) as last_seen values(message) as messages by host
| where count > 0
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| sort - count

Wazuh OSSEC Rule

<group name="juniper,junos,bgp,">
  <rule id="100178" level="12">
    <decoded_as>json</decoded_as>
    <field name="program">rpd|bgp</field>
    <match>flowspec|flow-spec|core dumped|abnormal termination|panic</match>
    <description>CVE-2026-102178: Junos BGP routing daemon crash/restart possibly triggered by malicious flowspec re-advertisement</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>

  <rule id="100179" level="10">
    <decoded_as>json</decoded_as>
    <field name="program">rpd</field>
    <match>restart|terminated|signal</match>
    <description>Junos rpd process restart - possible BGP flowspec exploitation (CVE-2026-102178)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix version, workaround from the vendor, or affected-version enumeration is available. There is no CISA KEV listing and no public exploit. Treat this as a zero-day-class exposure until Juniper publishes an advisory and fixed release.

1) Immediate mitigations (reduce exposure):

• Disable BGP update-threading on affected devices where operationally feasible — the vulnerability is explicitly gated by update-threading being enabled. Validate the change against maintenance windows and routing stability requirements.
• Restrict BGP flowspec peering to only fully trusted peers. Remove flowspec address-family negotiation from any semi-trusted, multi-tenant, customer, or IXP peer where it is not strictly required. Enforce strict prefix/peer ACLs so only known-good session sources can establish BGP.
• Apply inbound flowspec route filtering (policy) that rejects malformed or unexpected flowspec NLRI and limits the volume/rate of flowspec routes a peer may advertise.
• Segment management and control plane; ensure the routing engine is not reachable by untrusted hosts beyond the BGP session surface. Monitor BGP peer configuration for unauthorized additions of flowspec peers.
• Where the feature is not required, disable BGP flowspec entirely.

2) Patch / upgrade steps:

• Monitor the Juniper security advisories portal and the NVD entry for CVE-2026-102178 for the availability of a fixed Junos OS / Junos OS Evolved release.
• When a fixed release is published, follow Juniper's recommended upgrade path, stage in a lab, and prioritize edge/PE routers that peer with untrusted parties and have flowspec + update-threading enabled.
• Until a fixed release exists, do not assume version-based mitigation; rely on the configuration mitigations above.

3) Long-term hardening:

• Adopt a control-plane security posture that treats all BGP peers — including flowspec peers — as untrusted for the purposes of protocol parsing.
• Enable and monitor logging for routing-daemon crashes; alert on any rpd restart as a potential exploitation signal.
• Maintain baseline BGP update/flowspec volume per peer and alert on deviation.
• Keep routing-engine firmware current and subscribe to Juniper SIRT advisories for proactive notification of this and related routing-protocol vulnerabilities.

References

• NVD — CVE-2026-102178: https://nvd.nist.gov/vuln/detail/CVE-2026-102178
• Juniper Networks Security Advisories (monitor for the assigned advisory and fixed releases): https://supportportal.juniper.net/s/global-search/%40uri#t=SecurityAdvisories
• CWE-121 — Stack-based Buffer Overflow: https://cwe.mitre.org/data/definitions/121.html
• RFC 8955 — Dissemination of Flow Specification Rules (BGP flowspec, context for the affected protocol path): https://datatracker.ietf.org/doc/html/rfc8955
• CISA Known Exploited Vulnerabilities Catalog (check for future listing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / exploit-in-the-wild evidence: none. As of this report, CVE-2026-102178 is not listed in CISA KEV, has no public PoC, no exploit code, and no detected in-the-wild exploitation. EPSS has not yet scored this CVE; no value is asserted.