CVE-2026-102179

Executive Summary

CVE-2026-102179 is an out-of-bounds write (CWE-787) in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. An attacker who holds a configured BGP EVPN peer session can crash rpd by supplying crafted BGP EVPN routes while the l2vpn-evpn RIB telemetry sensor is subscribed, disrupting routing protocols until the daemon restarts and reconverges. The vulnerability is rated 7.5 (High) with network attack vector, no privileges or user interaction required, and total loss of availability; no patch or vendor fix is currently confirmed, and no public PoC or exploit code exists.

Technical Analysis

The flaw is classified as an out-of-bounds write in the routing protocol daemon (rpd), the process responsible for all routing protocol operation on Junos OS and Junos OS Evolved devices. The trigger surface is BGP EVPN route processing. According to the NVD description, the defect is only reachable when two conditions are simultaneously satisfied:

1. The attacker has access to a configured BGP EVPN peer (i.e., an established BGP session negotiating the EVPN address family).
2. The l2vpn-evpn RIB telemetry sensor is subscribed on the target device.

When BGP EVPN route information is processed in this state, the affected code path writes beyond the bounds of its allocated buffer. Because the write occurs inside rpd, corruption of daemon memory leads directly to a crash, which the description states interrupts routing protocols until the daemon restarts and reconverges.

The precise structure, length field, or parsing routine responsible for the overflow is not identified in the available CVE description or CNA title. No affected function names, file paths, route attribute types, or telemetry schema fields are provided in the source data. The description does not disclose whether the overflow is driven by a specific EVPN route type, an attribute length inconsistency, or a telemetry-encoding interaction; that level of detail must not be assumed. What is defensible from the data is the vulnerability class: a memory-safety violation (out-of-bounds write) in a network-facing routing daemon, reachable through normal BGP EVPN protocol messages, with the telemetry subscription acting as a precondition for the vulnerable code path.

The telemetry precondition is operationally significant. The l2vpn-evpn RIB telemetry sensor is an optional streaming/visibility feature; the vulnerable processing path appears tied to the interaction between route ingestion and telemetry export of the EVPN RIB. This narrows the exposed population to devices that both run BGP EVPN and have subscribed this sensor.

Exploitation Scenarios

No public PoC or exploit code is available; the attack chain below is inferred strictly from the vulnerability class and the stated preconditions. No specific function names, API parameters, or payload structures are asserted because the source data does not disclose them.

1. Reconnaissance / target identification. The attacker identifies a Junos OS or Junos OS Evolved device that terminates BGP EVPN (common in data-center and service-provider fabrics). Determining that the l2vpn-evpn RIB telemetry sensor is subscribed may be possible through topology knowledge, prior access, or operational inference; the CVE data does not state that the subscription state is remotely discoverable.

2. Prerequisite establishment. The attacker must already hold a configured BGP EVPN peer relationship with the target — either as a legitimate peer or by compromising/impersonating one. This is the gating condition: the flaw is not reachable from an arbitrary unauthenticated internet host without a BGP EVPN peering.

3. Trigger (vulnerability-class level). Over the established EVPN session, the attacker causes the target to process BGP EVPN route information that drives the daemon's out-of-bounds write. The exact malformed route construction is not specified in available data; generically, this means delivering EVPN route data whose processing in the telemetry-enabled path results in a write past an allocated buffer boundary.

4. Post-exploitation impact. The observable result is a crash of rpd. Routing protocols are interrupted, and service resumes only after the daemon restarts and reconverges. Because the CVSS vector reports Confidentiality and Integrity as None and Availability as High, the expected impact is denial of service rather than data exfiltration or code execution — though an out-of-bounds write in a network daemon is a memory-corruption class that should be treated as potentially more severe than the availability-only score implies.

Impact Assessment

CVSS:3.1 base score 7.5 (High), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

• Attack Vector: Network — triggerable across the network via an established BGP EVPN session.
• Attack Complexity: Low — no stated race condition, memory-layout dependence, or special preparation beyond the stated preconditions.
• Privileges Required: None — no additional local privileges beyond holding the configured peering.
• User Interaction: None — no operator action required to trigger.
• Scope: Unchanged — impact contained to the vulnerable component.
• Confidentiality / Integrity: None — no direct disclosure or modification per the vector.
• Availability: High — rpd crashes; routing and dependent forwarding control-plane functions are disrupted.

Blast radius. Junos OS and Junos OS Evolved devices configured for BGP EVPN with the l2vpn-evpn RIB telemetry sensor subscribed. In a data-center EVPN/VXLAN fabric, the affected device may be a spine, leaf, or route reflector; an rpd crash on a route reflector or border node can ripple across the fabric. Repeated triggering can produce sustained, restart-induced churn rather than a single outage.

EPSS: Not yet scored by FIRST.org; no EPSS value is asserted. CISA KEV: Not listed. Weaponization: No public exploit, no PoC, no Nuclei template. Risk is therefore driven by exposure of EVPN peering and telemetry, not by active exploitation.

Detection Guidance

The following rules are heuristic and target the vulnerability class (daemon crash, EVPN route processing anomalies, telemetry-sensor-correlated disruption). No signatures exist for the exact payload.

Sigma Rule

title: Juniper rpd Crash Correlated with BGP EVPN Route Processing (CVE-2026-102179)
id: 7c1d2f40-9a3b-4e8c-b1d2-102179aabb01
status: experimental
description: Detects rpd process termination/crash events on Junos OS that coincide with BGP EVPN activity or l2vpn-evpn telemetry subscription.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102179
author: valtersit.com
logsource:
  product: juniper
  service: syslog
detection:
  selection_crash:
    - 'rpd.*core'
    - 'rpd.*crash'
    - 'rpd.*terminated'
    - 'rpd.*restart'
    - 'process rpd'
  selection_evpn:
    - 'bgp.*evpn'
    - 'l2vpn-evpn'
    - 'evpn.*telemetry'
  condition: selection_crash and selection_evpn
fields:
  - host
  - message
falsepositives:
  - Planned rpd restarts, upgrade windows, unrelated daemon restarts
level: high

YARA Rule

rule CVE_2026_102179_Junos_rpd_OOB_Write_Crash_Marker
{
    meta:
        author = "valtersit.com"
        description = "Heuristic detection of Junos rpd crash artifacts associated with BGP EVPN route processing (CVE-2026-102179)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102179"
        cve = "CVE-2026-102179"
        date = "2026-01-01"
    strings:
        $rpd      = "rpd" ascii wide nocase
        $evpn     = "evpn" ascii wide nocase
        $l2vpn    = "l2vpn-evpn" ascii wide nocase
        $core     = "core" ascii wide nocase
        $signal   = "SIGSEGV" ascii wide
        $signal2  = "SIGABRT" ascii wide
    condition:
        2 of ($rpd, $evpn, $l2vpn) and 1 of ($core, $signal, $signal2)
}

Suricata IDS Rule

alert tcp any 179 -> any any (msg:"CVE-2026-102179 Juniper Junos BGP EVPN route processing anomaly targeting rpd"; flow:established,to_client; dport:179; content:"|02 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff|"; depth:19; byte_test:1,=,2,18; threshold:type limit, track by_src, count 1, seconds 60; reference:cve,2026-102179; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-102179; classtype:attempted-dos; sid:2026102179; rev:1;)

Note: BGP EVPN consumes the MP_REACH_NLRI path (AFI 25 / SAFI 70). The rule above is a coarse BGP-header heuristic and will require environment-specific tuning; there is no payload signature for the malformed EVPN route because none is publicly documented.

Elastic Detection

sequence by host.id with maxspan=5m
  [ process where event.type == "start" and process.name : "rpd" and event.action == "start" ]
  [ process where event.type == "end" and process.name : "rpd" and process.exit_code != 0 ]

This EQL rule fires when rpd exits abnormally and restarts within a five-minute window — the observable footprint of the CVE-2026-102179 crash/reconverge cycle on hosts shipping Junos process telemetry.

Splunk SPL Query

index=network sourcetype=juniper:syslog
| search ("rpd" AND ("core" OR "crash" OR "terminated" OR "restart" OR "SIGSEGV" OR "SIGABRT"))
| rex "(?<daemon>rpd)"
| stats count min(_time) as first_seen max(_time) as last_seen values(message) as events by host
| where count > 1
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| sort - count

Correlate with l2vpn-evpn telemetry subscription and BGP EVPN peering changes to raise confidence.

Wazuh OSSEC Rule

<group name="juniper,cve-2026-102179,">
  <rule id="1021790" level="12">
    <decoded_as>syslog</decoded_as>
    <match>rpd</match>
    <regex>core|crash|terminated|SIGSEGV|SIGABRT|restart</regex>
    <description>CVE-2026-102179: Juniper Junos rpd crash/restart possibly triggered by BGP EVPN route processing</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>denial_of_service,juniper_rpd_evpn,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No affected version ranges, vendor fix, or workarounds are disclosed in the available data.

1) Immediate mitigations

• Restrict BGP EVPN peering to trusted, explicitly configured peers using strict prefix/peer authorization and MD5/TCP-AO protections where supported. The vulnerability requires an established, configured EVPN peer, so tightening peering trust is the primary exposure control.
• If the l2vpn-evpn RIB telemetry sensor subscription is not operationally required, unsubscribe/disable it, since the description ties the vulnerable code path to that subscription.
• Apply control-plane protection and routing policy to limit which EVPN route information an allowed peer can inject.
• Monitor rpd for crashes/restarts and treat repeated crash-reconverge cycles on EVPN nodes as a potential exploitation indicator.

2) Patch/upgrade steps

• No fixed version is identified. Track the Juniper Networks security advisories and Junos OS / Junos OS Evolved release notes for a CVE-2026-102179 fix, and upgrade to the corrected release once published. Do not assume any current release is remediated.

3) Long-term hardening

• Treat routing daemons as high-value control-plane attack surface; enforce least-privilege peering and route filtering throughout EVPN fabrics.
• Inventory devices running BGP EVPN with the l2vpn-evpn telemetry sensor subscribed to quantify exposure.
• Adopt continuous CVE monitoring and maintain tested rollback/convergence procedures for rpd restarts.

References

• NVD — CVE-2026-102179: https://nvd.nist.gov/vuln/detail/CVE-2026-102179
• MITRE CWE-787 (Out-of-bounds Write): https://cwe.mitre.org/data/definitions/787.html
• FIRST EPSS (not yet scored for this CVE): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE not listed as of reporting): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Juniper Networks Security Advisories portal (monitor for vendor advisory/fixed release): https://supportportal.juniper.net/

No threat-actor campaign, exploit-in-the-wild evidence, public PoC, or Nuclei template is associated with CVE-2026-102179 in the available data.