CVE-2026-102183

Executive Summary

CVE-2026-102183 is a denial-of-service vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved, caused by improper validation of a specified quantity in input (CWE-1284). A BGP EVPN peer that has been configured and established on a vulnerable device can send a specifically malformed Network Layer Reachability Information (NLRI) field that causes rpd to crash. The vulnerability carries a CVSS v3.1 base score of 7.5 (High), reflecting a network-reachable, low-complexity, unauthenticated-in-the-CVSS-sense attack path that results in complete loss of availability of the routing process, with no impact to confidentiality or integrity.

Technical Analysis

The affected component is the routing protocol daemon (rpd) within Juniper Networks Junos OS and Junos OS Evolved. The root cause is classified as CWE-1284, Improper Validation of Specified Quantity in Input. In protocol-parsing contexts, this weakness class occurs when a message field that encodes a count, length, or quantity is accepted and acted upon without being validated against the actual amount of data present or against a permitted maximum. When such an unvalidated quantity drives a memory operation, buffer allocation, or loop bound, the result can be a memory-safety fault or an uncontrolled resource condition that terminates the process.

In this specific case, the malformed quantity is carried inside a BGP EVPN NLRI. The NLRI is the route announcement payload of a BGP UPDATE message. For EVPN address family routes, the NLRI encodes route type, length, and route-type-specific data. The NVD description states that a "specifically malformed NLRI" is sufficient to cause an rpd crash. This indicates that the parsing path for EVPN NLRI does not correctly validate a quantity field within that structure before consuming it, and that malformed input reaches a code path that terminates rpd.

The attack surface is the BGP control plane. The key precondition — and the principal limiting factor — is that the attacker must be a configured BGP EVPN peer. BGP peers are explicitly configured on Junos devices; a random internet host cannot normally establish a peering session. This means the vulnerability is not remotely exploitable by arbitrary unauthenticated internet actors against a hardened device. However, the CVSS vector (AV:N/AC:L/PR:N/UI:N) reflects the network-oriented, low-complexity, no-privileges, no-user-interaction nature of the trigger once the peer relationship exists.

Because the affected daemon is rpd, a successful trigger causes the routing process to terminate. On Junos, rpd handles BGP, EVPN, and other routing protocol state. Its failure disrupts routing adjacencies, route propagation, and the device's participation in the routing fabric. The specific defensive check that should reject the malformed NLRI, and the exact malformed structure required, are not disclosed in the available NVD data. No public proof-of-concept, exploit code, or Nuclei template exists for this CVE, and no affected version ranges have been enumerated by tracked sources.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class (CWE-1284) and the mechanism described in the NVD record. No specific internal function names, API parameters, or file paths are asserted because none are provided in the source data.

1. Reconnaissance / target identification. The adversary identifies a Juniper device running Junos OS or Junos OS Evolved that is configured as part of a BGP EVPN deployment — for example, a data-center leaf/spine fabric or a provider edge device participating in EVPN. This may be achieved through topology mapping, BGP-looking-glass data, Shodan/Juniper J-Web fingerprinting, or knowledge of the target's network architecture. Critically, the attacker must already control or operate a BGP peer that the target has configured to accept EVPN advertisements from. This could be a compromised peer, a rogue device on a shared fabric, a subordinate network element, or a malicious insider/operator with peering capability.

2. Triggering the flaw class. From the established BGP EVPN session, the peer sends a BGP UPDATE message carrying a specifically malformed EVPN NLRI. The malformation targets a specified quantity field inside the NLRI — that is, a count or length value that is inconsistent with the data actually supplied or that exceeds a boundary the parser fails to enforce. Because rpd does not properly validate this quantity against the input, the parsing path reaches an unsafe state.

3. Payload / execution at the vulnerability-class level. For an improper-validation-of-quantity weakness, the malformed quantity typically drives a buffer operation or loop bound past what the data supports. The observable outcome in this CVE is a crash of rpd rather than disclosed code execution or data corruption, which is consistent with a memory-safety or assertion fault terminating the daemon. The exact wire-level byte layout required to trigger the crash is not publicly documented.

4. Post-exploitation impact. The immediate result is that rpd terminates on the target device. This disrupts BGP sessions and EVPN route state, potentially causing route withdrawal, traffic blackholing, or fabric reconvergence. If the target is a route reflector or a critical fabric node, the effects can cascade across dependent network segments. Repeated malformed updates from the same peer could induce a persistent crash/restart cycle, sustaining the denial of service. Impact is availability-only: no confidentiality or integrity compromise is claimed.

Impact Assessment

The CVSS v3.1 base score is 7.5 (High). The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H breaks down as follows: the attack is network-delivered (AV:N), requires low attack complexity (AC:L), requires no privileges (PR:N), and requires no user interaction (UI:N). Scope is unchanged (S:U) — exploitation affects only the vulnerable component's security authority. There is no confidentiality impact (C:N) and no integrity impact (I:N), but availability impact is high (A:H), consistent with a daemon crash.

Business impact. Affected systems are Juniper Junos OS and Junos OS Evolved devices configured with BGP EVPN. These are typically high-value network elements: data-center fabric leaf/spine switches, provider edge routers, and route reflectors carrying production or customer traffic. A crashed rpd can remove a device from the routing control plane, causing traffic to reroute, blackhole, or be dropped until adjacencies reconverge. In service-provider or large enterprise environments, the blast radius of a single core or fabric node failure can extend to entire tenants, services, or regions depending on topology redundancy.

Attacker requirements limit real-world reach. The most important qualifier is the precondition that the adversary must be a configured BGP EVPN peer. This substantially narrows the threat to actors who have already achieved a foothold or peering position within the routing fabric — a malicious peer, a compromised subordinate device, or an operator with the ability to inject EVPN advertisements. It is not a drive-by, internet-scale vulnerability. Nonetheless, the impact when triggered is severe because it targets the routing control plane itself.

No exploitation evidence. There is no CISA KEV listing, no public exploit code, no Nuclei template, and no EPSS score at the time of writing. The EPSS value is not yet provided by FIRST.org and must not be assumed.

Detection Guidance

Detection focuses on the BGP control plane: monitoring rpd process health, BGP session stability, and malformed EVPN UPDATE activity from peers.

Sigma Rule

title: Juniper rpd Crash via Malformed BGP EVPN NLRI (CVE-2026-102183)
id: 8f2c1a44-5b7e-4d1a-9c3e-102183cve2026
status: experimental
description: Detects crash or restart of the Juniper rpd process, potentially caused by a malformed BGP EVPN NLRI from a configured peer.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102183
author: valtersit.com
date: 2026/01/01
logsource:
  product: juniper
  service: junos
  definition: Junos syslog / event logs forwarded to SIEM
detection:
  selection_crash:
    - message|contains: 'rpd'
    - message|contains: 'process ended'
  selection_restart:
    - message|contains: 'rpd'
    - 'message|contains|all':
        - 'startup'
  condition: selection_crash or selection_restart
falsepositives:
  - Legitimate rpd restarts during maintenance or failover events
level: high
tags:
  - attack.t1498
  - cve.2026.102183

YARA Rule

rule CVE_2026_102183_Junos_rpd_EVPN
{
    meta:
        description = "Detects Junos rpd / BGP EVPN artifacts related to CVE-2026-102183 (malformed EVPN NLRI crash)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102183"
        date = "2026-01-01"
        severity = "high"

    strings:
        $s1 = "rpd" ascii wide
        $s2 = "EVPN" ascii wide
        $s3 = "BGP" ascii wide
        $s4 = "nlri" ascii wide nocase

    condition:
        uint32(0) == 0x7f454c46 and 2 of ($s*)
}

Suricata IDS Rule

alert tcp any 179 -> any any (msg:"CVE-2026-102183 Possible Malformed BGP EVPN NLRI from Peer"; flow:established,to_client; content:"|FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF|"; depth:16; content:"|02|"; within:19; app-layer-protocol:bgp; threshold:type limit, track by_src, count 5, seconds 60; classtype:attempted-dos; sid:2026102183; rev:1; reference:cve,2026-102183;)

Note: BGP UPDATE messages begin with a 16-byte marker of all 0xFF followed by a length and type (0x02 = UPDATE). The rule is a coarse control-plane anomaly indicator; production tuning against baseline EVPN NLRI structure is required.

Elastic Detection

process where event.type == "end" and
  process.name == "rpd" and
  process.command_line != null

sequence by host.id with maxspan=5m
  [process where process.name == "rpd" and event.type == "end"] by host.id
  [process where process.name == "rpd" and event.type == "start"] by host.id

The second query correlates an rpd termination followed by a restart — a signature of a crash loop potentially driven by repeated malformed input.

Splunk SPL Query

index=juniper sourcetype=junos:syslog ("rpd" AND ("crash" OR "core" OR "restart" OR "exited" OR "process") )
| stats count by host, _time, _raw
| where count > 0
| table _time host _raw

Correlation query for rapid rpd restarts per host:

index=juniper sourcetype=junos:syslog "rpd" ("startup" OR "ready")
| bin _time span=5m
| stats count as restarts by host, _time
| where restarts >= 2

Wazuh OSSEC Rule

<group name="juniper,junos,rpd,">
  <rule id="102183" level="12">
    <decoded_as>syslog</decoded_as>
    <match>rpd</match>
    <regex>(crash|core dump|terminated|process ended|restart)</regex>
    <description>CVE-2026-102183: Juniper rpd crash/restart detected - possible malformed BGP EVPN NLRI</description>
    <mitre>
      <id>T1498</id>
    </mitre>
    <group>cve_2026_102183,denial_of_service,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version list is present in the available intelligence. The following guidance is based on the vulnerability class and standard Junos operational practice; it must be validated against Juniper's official advisory before application.

1. Immediate mitigations.

• Restrict BGP EVPN peering to explicitly trusted, controlled neighbors. Because the trigger requires a configured EVPN peer, reducing the set of peers and ensuring their integrity is the single most effective compensating control.
• Apply BGP authentication (TCP MD5 / TCP-AO) and, where supported, GTSM/TTL-security on all BGP sessions to prevent session hijacking by unauthorized parties.
• Monitor rpd process stability and log a high-severity alert on any unexpected rpd termination or restart (see Detection Guidance). Early detection of a crash loop provides warning of active exploitation.
• Where operationally feasible, evaluate route policy and control-plane policing to constrain the volume and source of EVPN NLRI-bearing updates, limiting an attacker's ability to sustain repeated crash attempts.
• Validate any suspected trigger traffic against Juniper's official guidance rather than inferring the exact malformation from this report, which does not disclose the wire format.

2. Patch / upgrade steps.

• No patch is identified by tracked sources. Monitor the Juniper Networks security advisories page (https://supportportal.juniper.net/ and https://www.juniper.net/security) for a vendor advisory and fixed Junos OS / Junos OS Evolved releases specific to this CVE.
• When a fixed release is published, stage it in a lab replica, validate EVPN adjacency and route convergence after upgrade, then deploy per standard Junos software upgrade procedure with rollback safety.
• Track the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-102183) for affected version ranges and reference links.

3. Long-term hardening.

• Enforce least-privilege on routing infrastructure: only authorized, inventoried devices should be permitted as EVPN peers.
• Segment and protect the routing control plane with out-of-band management, strict ACLs on port 179, and role-based access to device configuration.
• Deploy continuous control-plane monitoring that baselines BGP session counts, EVPN route volumes, and rpd resource usage, so anomalies and crash/restart cycles are detected in near real time.
• Maintain network-layer redundancy (redundant route reflectors, diverse fabric paths) so that a single rpd crash does not translate into an outage.
• Establish a vulnerability-management cadence that ingests Juniper advisories and CISA KEV updates, since this CVE currently has no patch and may be added to KEV if exploitation emerges.

References

1. NVD — CVE-2026-102183: https://nvd.nist.gov/vuln/detail/CVE-2026-102183
2. MITRE CWE-1284 — Improper Validation of Specified Quantity in Input: https://cwe.mitre.org/data/definitions/1284.html
3. Juniper Networks Security Advisories: https://supportportal.juniper.net/ (and https://www.juniper.net/security)
4. CISA Known Exploited Vulnerabilities Catalog (check current status; not listed at time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
5. FIRST EPSS (score not yet assigned at time of writing): https://www.first.org/epss/

Exploit-in-the-wild / threat actor note: No public PoC, exploit code, Nuclei template, CISA KEV entry, or known threat actor campaign is associated with CVE-2026-102183 in the available data. The absence of public exploitation does not preclude targeted abuse by actors with an existing BGP EVPN peering foothold, since the trigger requires only a malformed NLRI from an already-configured peer.