CVE-2026-102180

Executive Summary

CVE-2026-102180 is a stack-based buffer overflow (CWE-121) in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. An attacker with access to a configured BGP peering session can cause a denial of service by sending a crafted BGP route attribute that is processed while a BGP RIB streaming telemetry subscription is active. The vulnerability affects Junos OS and Junos OS Evolved versions 22.1R1 and later; versions prior to 22.1R1 are not affected. With a CVSS score of 7.5 (High) and no patch or public exploit currently available, this represents a significant availability risk for organizations running affected Juniper platforms with BGP and streaming telemetry enabled.

Technical Analysis

The vulnerability is classified as CWE-121 (Stack-based Buffer Overflow) and resides within the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. The rpd process is responsible for managing routing protocols, including BGP, and is a core component of the Junos control plane.

According to the NVD description, the flaw is triggered when a crafted BGP route attribute is processed while a BGP RIB streaming telemetry subscription is active. This is a critical precondition: the attacker must have access to a configured BGP peering session, and the target device must have an active BGP RIB streaming telemetry subscription. The vulnerability does not affect Junos OS versions prior to 22.1R1, nor Junos OS Evolved versions prior to 22.1R1-EVO, suggesting the vulnerable code path was introduced in the 22.1R1 release cycle.

The attack surface is network-accessible via BGP (TCP port 179). The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) indicates that the attack is network-exploitable, requires low complexity, no privileges, and no user interaction. The impact is exclusively to availability (A:H), consistent with a denial-of-service condition. A stack-based buffer overflow in a control-plane daemon such as rpd can lead to process crash, potentially causing routing instability or a full device restart depending on process supervision and fault handling.

The specific BGP route attribute involved, the exact overflow length, and the code-level mechanics are not detailed in the available description. No function names, memory offsets, or attribute types are provided. The vulnerability class (stack-based buffer overflow) implies that insufficient bounds checking occurs when parsing or copying the crafted route attribute into a fixed-size stack buffer.

Exploitation Scenarios

The following attack chain is inferred from the vulnerability class and the NVD description. No public PoC is available.

Step 1 — Reconnaissance / Target Identification: An attacker identifies a target Juniper device running Junos OS or Junos OS Evolved version 22.1R1 or later. The attacker must determine that the device has an established BGP peering session to which they have access (either as a configured peer or by compromising a legitimate peer). The attacker must also confirm that a BGP RIB streaming telemetry subscription is active on the target.

Step 2 — Triggering the Flaw: The attacker, operating from an authorized or compromised BGP peering session, sends a crafted BGP UPDATE message containing a malicious route attribute. Because the BGP RIB streaming telemetry subscription is active, the rpd process processes this attribute through the vulnerable code path, causing a stack-based buffer overflow.

Step 3 — Payload / Execution Method (Class Level): At the vulnerability-class level, the crafted route attribute contains data that exceeds the bounds of a fixed-size stack buffer in the rpd process. The overflow corrupts adjacent stack memory. The specific attribute type, encoding, and overflow payload structure are not detailed in the available intelligence. Given the CVSS impact subscore (C:N/I:N/A:H), the outcome is process disruption or crash rather than code execution.

Step 4 — Post-Exploitation Impact: The rpd process crashes or becomes unstable, resulting in a denial of service. Depending on Junos process supervision, this may cause BGP session resets, routing table instability, or a device restart. The attacker does not gain confidentiality or integrity impact per the CVSS vector.

Impact Assessment

The CVSS 3.1 base score is 7.5 (High), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. This reflects:

• Attack Vector (Network): Exploitable remotely over the network via BGP.
• Attack Complexity (Low): No special conditions beyond an active BGP peering session and telemetry subscription.
• Privileges Required (None): No authentication beyond the BGP peering relationship.
• User Interaction (None): No user action required.
• Scope (Unchanged): Impact confined to the vulnerable component.
• Confidentiality (None) / Integrity (None): No data exposure or modification.
• Availability (High): Complete loss of availability of the affected routing daemon.

Business impact includes potential network outages, routing disruptions, and degradation of service for downstream networks relying on the affected router. Organizations using Juniper platforms as BGP route reflectors or edge routers with streaming telemetry are at elevated risk. The blast radius extends to any network segment dependent on the affected device's routing functions. No EPSS score is available, and the vulnerability is not listed in CISA KEV.

Detection Guidance

Sigma Rule

title: Juniper rpd Stack Buffer Overflow via BGP Route Attribute (CVE-2026-102180)
id: 8f3c2a1e-4b7d-4e2a-9c1f-6d5e8a7b3c2d
status: experimental
description: Detects potential exploitation of CVE-2026-102180 via abnormal rpd crashes or BGP attribute processing anomalies
author: Threat Intelligence
date: 2026-01-01
logsource:
    product: juniper
    service: junos
detection:
    selection_rpd:
        process|contains: 'rpd'
    selection_crash:
        message|contains:
            - 'rpd'
            - 'stack'
            - 'buffer overflow'
            - 'core dump'
    selection_bgp:
        message|contains:
            - 'BGP'
            - 'route attribute'
    condition: selection_rpd and (selection_crash or selection_bgp)
falsepositives:
    - Legitimate rpd restarts
    - BGP session resets during maintenance
level: high

YARA Rule

rule CVE_2026_102180_Juniper_rpd_BGP_Overflow
{
    meta:
        description = "Detects indicators of CVE-2026-102180 in Juniper Junos rpd memory dumps or logs"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "CVE-2026-102180"
        severity = "high"

    strings:
        $rpd = "rpd" ascii wide nocase
        $bgp = "BGP" ascii wide
        $attr = "route attribute" ascii wide nocase
        $stack = "stack" ascii wide nocase
        $telemetry = "streaming telemetry" ascii wide nocase
        $rib = "RIB" ascii wide

    condition:
        uint32(0) == 0x464C457F or
        (2 of ($rpd, $bgp, $attr, $stack, $telemetry, $rib))
}

Suricata IDS Rule

alert tcp any any -> any 179 (msg:"CVE-2026-102180 Juniper rpd BGP Route Attribute Stack Buffer Overflow Attempt"; flow:established,to_server; content:"|FF FF FF FF|"; depth:1; content:"|02|"; within:2; byte_test:1,>,19,0,relative; reference:cve,2026-102180; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-102180; classtype:attempted-dos; sid:2026102180; rev:1;)

Elastic Detection

process where process.name == "rpd" and
  (message like~ "*buffer overflow*" or
   message like~ "*stack*corrupt*" or
   message like~ "*BGP*route attribute*" or
   event.action == "core_dump")

Splunk SPL Query

index=juniper sourcetype=junos:log (process=rpd OR "rpd") ("buffer overflow" OR "stack" OR "core dump" OR "BGP route attribute")
| stats count by host, process, message
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="juniper,cve-2026-102180,">
  <rule id="2026102" level="12">
    <decoded_as>json</decoded_as>
    <field name="program">rpd</field>
    <match>buffer overflow|stack|core dump|BGP route attribute</match>
    <description>CVE-2026-102180: Possible Juniper rpd stack buffer overflow via crafted BGP route attribute</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>dos,availability,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1) Immediate Mitigations:

• Restrict BGP peering sessions to trusted, explicitly configured peers using BGP authentication (TCP MD5 / TCP-AO) and prefix limits.
• Disable BGP RIB streaming telemetry subscriptions where operationally feasible until a patch is available, as the vulnerability requires an active subscription to trigger.
• Apply BGP route attribute filtering and sanity checks (e.g., maximum attribute lengths) at the control-plane level where supported by Junos policy.
• Monitor rpd process stability and logs for crash or restart indicators.

2) Patch/Upgrade Steps:

• No vendor patch or fixed version is currently available from tracked sources. Monitor Juniper Networks security advisories and the official Junos OS / Junos OS Evolved release notes for updates.
• Once a fixed release is published, upgrade affected devices running 22.1R1 or later to the vendor-recommended patched version.

3) Long-Term Hardening:

• Enforce strict BGP peer authentication and route policy controls.
• Minimize the number of BGP peers and exposed control-plane interfaces.
• Deploy out-of-band telemetry monitoring and process supervision to detect rpd anomalies.
• Maintain an inventory of Junos OS and Junos OS Evolved versions and track vendor advisories for timely upgrades.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-102180
• Juniper Networks Security Advisories: https://supportportal.juniper.net/s/global-search/%40uri
• MITRE ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
• CWE-121 — Stack-based Buffer Overflow: https://cwe.mitre.org/data/definitions/121.html
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-102180 not listed as of report date)

No public PoC, exploit code, Nuclei template, or in-the-wild campaign evidence is currently associated with CVE-2026-102180.