CVE-2026-102184

Executive Summary

CVE-2026-102184 is an improper input validation flaw (CWE-1284) in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos Evolved platforms. A network-adjacent attacker who is already a configured EVPN signaling peer can send an EVPN route update carrying a malformed SRv6 structure that triggers an rpd crash, causing a denial of service that disrupts routing adjacencies. The vulnerability is rated CVSS 7.5 (High) and currently has no known public exploit, no PoC, and no vendor patch evidence in tracked sources.

Technical Analysis

The vulnerability resides in the routing protocol daemon (rpd), the Junos process responsible for running routing protocols such as BGP, including the EVPN address family. EVPN (Ethernet VPN) signaling peers exchange route updates that may carry SRv6 (Segment Routing over IPv6) structures used for segment-routed transport. The NVD description states the flaw is an "Improper Validation of Specified Quantity in Input" (CWE-1284), meaning the daemon fails to correctly validate a quantity/length field embedded in the SRv6 structure before using it. When a malformed SRv6 structure is carried in an EVPN route update, the improperly validated quantity leads to a fault condition in rpd, terminating the daemon process.

The attack surface is the control plane: specifically the EVPN signaling session established between BGP/EVPN peers. Because the trigger is an EVPN route update, the attacker must be an authenticated, configured EVPN signaling peer — the peer relationship is a precondition. The Crafted update is delivered over the established routing session rather than requiring unauthenticated network access. The result is a process crash of rpd, which the platform generally attempts to restart; during the resulting window, routing adjacencies are lost or reconverge, producing a denial-of-service condition affecting routing adjacencies.

No specific function names, internal structures, or exact length thresholds are provided in the available data. Accordingly, the precise malformed field and the affected code path within rpd cannot be characterized beyond the vulnerability class: insufficient validation of a length/quantity field within an SRv6 structure embedded in EVPN NLRI.

Exploitation Scenarios

No public exploitation code or proof-of-concept is available. The attack chain below is inferred from the vulnerability class and the control-plane attack surface described in the NVD entry; it introduces no implementation specifics that are not supported by the source data.

1. Reconnaissance / target identification: The attacker identifies a Juniper device running Junos OS or Junos Evolved that has EVPN signaling configured and an established peer relationship in which the attacker participates. Because exploitation requires being a configured EVPN signaling peer, the attacker must already hold a valid peering position (e.g., a compromised or malicious route reflector/client, or a tenant-controlled routing device federated into the topology).

2. Triggering the flaw class: Over the established EVPN session, the attacker transmits an EVPN route update that carries an SRv6 structure. The SRv6 structure contains a quantity/length field that rpd fails to validate correctly (CWE-1284). The malformed quantity is processed without adequate bounds or consistency checking.

3. Payload / execution at the vulnerability-class level: The malformed EVPN update is parsed by rpd. Because the specified quantity in the input is improper, subsequent processing operates on an inconsistent internal state, causing an unrecoverable fault that crashes the rpd process. No memory-corruption or code-execution primitive is claimed; the demonstrated outcome is a crash.

4. Post-exploitation impact: The rpd crash terminates routing protocol processing, dropping routing adjacencies. Until rpd restarts and adjacencies reconverge, forwarding and control-plane stability are degraded, producing a denial of service. Repeatedly sending the malformed update can, depending on platform restart behavior, induce a sustained or recurring DoS condition.

Impact Assessment

The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yields a base score of 7.5 (High). The subscores indicate: network attack vector (AV:N), low attack complexity (AC:L), no privileges required within the CVSS abstraction (PR:N), no user interaction (UI:N), unchanged scope (S:U), no confidentiality impact (C:N), no integrity impact (I:N), and high availability impact (A:H). The practical interpretation is that an attacker positioned as a configured EVPN signaling peer can cause a high-impact availability loss with low complexity and no user involvement.

Business impact centers on network availability: loss of routing adjacencies can cause traffic blackholing, suboptimal or failed reconvergence, and disruption to services riding on the affected routing domain. Blast radius is bounded by the EVPN topology — the affected device and the adjacencies/services depending on it — but in large service-provider or data-center fabrics, a crash of a route reflector or spine rpd can cascade to many downstream prefixes. The peer-authentication precondition limits unauthenticated remote exploitation, which is why the vector does not reflect a fully unauthenticated internet-wide threat despite AV:N.

Because the CVSS privilege metric (PR:N) is a scoring abstraction, the operational reality remains that an EVPN peering relationship is required, which materially raises the attacker's bar compared with an unauthenticated one-packet attack.

Detection Guidance

Sigma Rule

title: Junos rpd Crash via Malformed SRv6 Structure in EVPN Route Update
id: 8f4b2c1e-7d3a-4a91-9c2f-junos102184
status: experimental
description: Detects rpd process crash/restart events on Juniper Junos that may indicate exploitation of CVE-2026-102184 via malformed SRv6 EVPN update
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102184
author: valtersit.com
date: 2026/01/01
logsource:
  product: juniper
  service: rpd
detection:
  selection_crash:
    process|contains: 'rpd'
    event.action|contains:
      - 'crashed'
      - 'core-dump'
      - 'restart'
  selection_evpn:
    message|contains:
      - 'EVPN'
      - 'SRv6'
  condition: selection_crash and selection_evpn
fields:
  - host
  - process
  - event.action
  - message
falsepositives:
  - Legitimate rpd restarts during maintenance or software upgrades
level: high

YARA Rule

rule CVE_2026_102184_Junos_rpd_EVPN_SRv6
{
    meta:
        description = "Detects Junos rpd core dumps referencing EVPN SRv6 processing associated with CVE-2026-102184"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102184"
        date = "2026-01-01"
    strings:
        $rpd = "rpd" ascii wide nocase
        $evpn = "EVPN" ascii wide nocase
        $srv6 = "SRv6" ascii wide nocase
        $crash = "core" ascii wide nocase
    condition:
        filesize < 50MB and
        $rpd and $evpn and $srv6
}

Suricata IDS Rule

alert bgp any any -> any any (msg:"CVE-2026-102184 Juniper Junos rpd malformed SRv6 structure in EVPN route update"; flow:to_server,established; content:"|02 01|"; byte_test:2,>,1500,0,relative; reference:cve,2026-102184; classtype:attempted-dos; sid:2026102184; rev:1;)

Elastic Detection

process where process.name == "rpd" and
  (event.action == "crashed" or event.action == "core_dump" or event.action == "restart")
  and message : ("EVPN" or "SRv6")

Splunk SPL Query

index=juniper sourcetype=juniper:junos (process="rpd") (message="*EVPN*" OR message="*SRv6*") (message="*crash*" OR message="*core*" OR message="*restart*")
| stats count min(_time) as firstTime max(_time) as lastTime by host process message
| where count > 1
| convert ctime(firstTime) ctime(lastTime)

Wazuh OSSEC Rule

<group name="juniper,junos,">
  <rule id="102184" level="12">
    <decoded_as>json</decoded_as>
    <field name="process">rpd</field>
    <match>EVPN|SRv6</match>
    <regex>crash|core|restart</regex>
    <description>CVE-2026-102184: Junos rpd crash possibly caused by malformed SRv6 EVPN update</description>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence is available from any tracked source, and no vendor fix has been identified in the provided data. The following are mitigations only.

1. Immediate mitigations:

   • Restrict EVPN signaling peers to trusted, configured devices and enforce authentication of BGP/EVPN sessions so that only legitimate peers can send route updates.
   • Apply BGP/EVPN route-update filtering and prefix/policy limits on EVPN sessions to constrain what a peer may advertise.
   • Where feasible, disable SRv6 processing on EVPN sessions that do not require it, reducing the exposed parsing surface.
   • Consider increasing monitoring of rpd process stability to detect and alert on crash/restart events promptly.

2. Patch/upgrade steps:

   • No patched release is identified in the available data. Monitor the Juniper Networks security advisories page (https://supportportal.juniper.net/) for a fixed Junos OS / Junos Evolved release addressing CVE-2026-102184.
   • When a fix is published, apply it to all EVPN-speaking devices and validate rpd stability post-upgrade.

3. Long-term hardening:

   • Segment routing control planes: limit EVPN peering to the minimal necessary set of nodes and authenticate all sessions.
   • Maintain a patch-management process that tracks Juniper PSIRT advisories and prioritizes control-plane denial-of-service issues in core routing infrastructure.
   • Deploy route-flap dampening and maximum-prefix limits to limit the blast radius of any single misbehaving or malicious EVPN peer.

References

1. NVD — CVE-2026-102184: https://nvd.nist.gov/vuln/detail/CVE-2026-102184
2. CWE-1284 — Improper Validation of Specified Quantity in Input: https://cwe.mitre.org/data/definitions/1284.html
3. Juniper Networks Security Advisories / PSIRT: https://supportportal.juniper.net/
4. ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/

No public proof-of-concept, exploit code, or Nuclei template is known at the time of writing. There is no CISA KEV entry and no confirmed exploit-in-the-wild evidence, and no threat-actor campaign reference is available for this CVE. EPSS has not yet been scored by FIRST.org.