CVE-2026-102185

Executive Summary

CVE-2026-102185 is an infinite loop vulnerability (CWE-835) in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved, triggered by EVPN multihoming with preference-based designated-forwarder (DF) election. A remote, unauthenticated network attacker can exploit this condition to hang the rpd process, causing a denial of service (CVSS 7.5, availability impact High). Organizations running Junos OS in EVPN multihoming deployments are affected; no patch, PoC, or active exploitation has been observed to date.

Technical Analysis

The vulnerability resides in the routing protocol daemon (rpd), the Junos process responsible for routing protocol operation, including EVPN (Ethernet VPN) control-plane signaling. EVPN multihoming enables a host or network segment to be connected to multiple provider edge (PE) devices while presenting a single logical multihomed Ethernet segment to the customer. A critical function of EVPN multihoming is designated-forwarder (DF) election, which selects exactly one PE to forward broadcast, unknown-unicast, and multicast (BUM) traffic onto a multihomed Ethernet segment. Junos supports multiple DF election modes, one of which is preference-based election, where candidate PEs advertise a preference value and the highest-preference (with tie-breakers) candidate wins the DF role.

CWE-835 ("Loop with Unreachable Exit Condition" / infinite loop) indicates that a code path within rpd's DF election logic does not terminate under certain conditions reachable via EVPN multihoming signaling. When the loop condition cannot be satisfied — for example, when the algorithm's internal state never converges on a terminating condition — the execution path keeps cycling rather than breaking out. Because rpd is a single-process control-plane daemon, an infinite loop in one code path blocks the process from servicing that event loop, effectively hanging routing protocol processing.

The attack surface is network-exposed: EVPN multihoming signaling is carried over BGP, and BGP peers/sessions are reachable over the network. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the flaw is exploitable remotely with low complexity, requiring no privileges and no user interaction — consistent with an attacker able to inject or manipulate EVPN multihoming state (e.g., a malicious or compromised PE/BGP peer, or a crafted control-plane advertisement).

Precise code-level details — function names, exact comparison boundaries, election algorithm internals — are not disclosed in the available description. The mechanism should therefore be understood at the vulnerability-class level: a non-terminating loop in rpd's preference-based DF election path, reachable via EVPN multihoming signaling, that halts the routing protocol daemon.

Exploitation Scenarios

No public PoC or exploit code is available; the attack chain below is inferred from the vulnerability class and the NVD description. It avoids inventing any implementation specifics not present in the source data.

1. Reconnaissance / target identification: The attacker identifies a target network running Juniper Junos OS or Junos OS Evolved with EVPN multihoming enabled and using preference-based designated-forwarder election. This deployment state is typically discoverable by observing EVPN/BGP control-plane advertisements, reachable BGP peers, or public scanning for exposed Junos control-plane services (e.g., BGP port 179, J-Web management interfaces).

2. Triggering the flaw class: The attacker causes rpd to enter the vulnerable DF election code path while driving the election state into a condition that never reaches a terminating exit — i.e., an infinite loop (CWE-835). Because the vulnerability is defined in the context of EVPN multihoming with preference-based DF election, the trigger involves multihoming DF election signaling. The exact controlling input (e.g., a crafted or malformed preference/election advertisement that prevents convergence) is not specified in the available description and cannot be stated with confidence.

3. Execution method at vulnerability-class level: The attacker sends network-borne EVPN multihoming control-plane signaling to the target PE such that preference-based DF election processing loops without exit. No authentication, privileges, or user interaction are required (per the CVSS vector). No payload beyond valid control-plane signaling reachable to rpd is implied, and no specific packet format is documented.

4. Post-exploitation impact: The infinite loop hangs the routing protocol daemon. With rpd unable to service its event loop, routing protocol processing on the affected device stalls, resulting in denial of service. Depending on Junos process supervision behavior, this may manifest as loss of routing adjacencies, instability of EVPN multihoming forwarding, or broader routing degradation for the node. The CVSS impact is availability-only (C:N/I:N/A:H), so no direct confidentiality or integrity impact is claimed.

Impact Assessment

• CVSS 3.1 base score: 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
• Confidentiality: None. Integrity: None. Availability: High.
• Attack vector Network, complexity Low, no privileges, no user interaction — a low barrier to trigger for an attacker with network reachability to the affected control plane.
• Blast radius is tied to the role of the affected device: a hang of rpd on a PE participating in EVPN multihoming can disrupt EVPN forwarding and BUM traffic handling for the multihomed segment, and stall routing protocol adjacencies on that node. Impact is per-device and can propagate to dependent network segments if the device is a critical routing node.
• No EPSS score is available (not yet scored by FIRST.org); no CISA KEV listing; no known in-the-wild exploitation.

Detection Guidance

Sigma Rule

title: Junos rpd Infinite Loop / EVPN Multihoming DF Election DoS (CVE-2026-102185)
id: 8b3f2c14-5d6a-4e21-9f70-102185000000
status: experimental
description: Detects indicators of rpd hang or restart correlated with EVPN multihoming DF election activity on Juniper Junos OS.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102185
author: valtersit.com
date: 2026/01/01
logsource:
  product: juniper
  service: junos
detection:
  selection_process:
    - process_name: 'rpd'
  selection_event:
    - message|contains:
        - 'rpd'
        - 'EVPN'
        - 'designated-forwarder'
        - 'DF election'
  selection_failure:
    - message|contains:
        - 'rpd.*not responding'
        - 'process rpd'
        - 'restart'
  condition: selection_process and (selection_event or selection_failure)
falsepositives:
  - Routine rpd restarts during maintenance
  - Administrative DF election reconfiguration
level: high

YARA Rule

rule CVE_2026_102185_Junos_rpd_EVPN_DF_InfiniteLoop
{
    meta:
        description = "Detection aid for CVE-2026-102185 Junos rpd EVPN multihoming DF election infinite loop indicators in logs/config"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102185"
        date = "2026-01-01"
        severity = "high"

    strings:
        $evpn = "evpn" ascii wide nocase
        $mh   = "multihoming" ascii wide nocase
        $df1  = "designated-forwarder" ascii wide nocase
        $df2  = "designated forwarder" ascii wide nocase
        $pref = "preference" ascii wide nocase
        $rpd  = "rpd" ascii wide nocase

    condition:
        filesize < 5MB and
        $rpd and $evpn and ($df1 or $df2) and ($mh or $pref)
}

Suricata IDS Rule

alert tcp any 179 -> any any (msg:"CVE-2026-102185 Juniper Junos rpd EVPN multihoming DF election DoS attempt (BGP EVPN)"; flow:to_server,established; content:"|2f|"; offset:0; depth:1; content:"EVPN"; nocase; content:"multihoming"; nocase; content:"preference"; nocase; threshold:type both, track by_src, count 20, seconds 60; classtype:attempted-dos; reference:cve,2026-102185; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-102185; sid:2026102185; rev:1;)

Elastic Detection

sequence by host.id with maxspan=5m
  [process where event.type == "start" and process.name == "rpd"]
  [any where
     (event.category == "network" and network.transport == "tcp" and network.destination.port == 179) or
     (event.category == "process" and process.name == "rpd" and
        (message wildcard "*EVPN*" or message wildcard "*designated-forwarder*" or message wildcard "*DF election*"))]

Splunk SPL Query

index=juniper sourcetype=junos:log
| search ("rpd" AND ("EVPN" OR "designated-forwarder" OR "evpn multihoming" OR "preference-based"))
| stats count, latest(_time) as last_seen, values(host) as hosts by message
| where count >= 5
| append [
    index=juniper sourcetype=junos:log
    | search "rpd" AND ("not responding" OR "restart" OR "core dump")
]

Wazuh OSSEC Rule

<group name="juniper,cve-2026-102185,">
  <rule id="1021850" level="10">
    <decoded_as>syslog</decoded_as>
    <match>rpd</match>
    <regex>EVPN|designated-forwarder|multihoming</regex>
    <description>CVE-2026-102185: Junos rpd EVPN multihoming DF election activity related to infinite loop DoS</description>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>

  <rule id="1021851" level="12">
    <decoded_as>syslog</decoded_as>
    <match>rpd</match>
    <regex>not responding|restart|core dump|crash</regex>
    <description>CVE-2026-102185: Junos rpd failure/restart possibly caused by EVPN multihoming infinite loop DoS</description>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence was found across any tracked source, and no vendor fix or workaround is provided in the available data. Affected version ranges are not available, so assumption-of-vulnerability must be made based on deployment feature configuration.

1. Immediate mitigations:

• Reduce exposure of the control plane: restrict BGP/EVPN peering to trusted, authorized PEs using authentication and peer-group filtering; do not accept multihoming EVPN control-plane signaling from untrusted sources.
• Harden management access (J-Web/SSH) with access lists and out-of-band paths so rpd failure cannot be compounded by management-plane exposure.
• Establish monitoring and alerting for rpd process health (restarts, hangs, core dumps) and for EVPN DF election anomalies on Junos devices.
• Where operationally feasible, consider alternative DF election configuration modes if preference-based election is not required — validate against the Juniper advisory before changing production policy.

2. Patch/upgrade steps:

• No patch is currently available. Monitor Juniper's security advisories and the NVD entry for CVE-2026-102185 for vendor fixes and affected version mapping.
• When a fix is published, plan an out-of-band maintenance upgrade of Junos OS / Junos OS Evolved on all EVPN multihoming PE devices, prioritizing internet-facing and multihomed critical nodes.

3. Long-term hardening:

• Adopt a vulnerability management process that tracks Junos advisories and applies patches on a defined SLA.
• Segment and protect the routing control plane (BGP/EVPN) with MD5/TCP-AO authentication, TTL security (GTSM), and maximum-prefix/route limits to constrain rogue peers.
• Deploy route processors and control-plane protection (e.g., loopback filters, rate limiting) to limit the impact of control-plane anomalies.
• Maintain rollback and redundancy for EVPN multihoming so that a single hung rpd does not cause segment-wide outage.

References

• NVD — CVE-2026-102185: https://nvd.nist.gov/vuln/detail/CVE-2026-102185
• CWE-835 — Loop with Unreachable Exit Condition ('Infinite Loop'): https://cwe.mitre.org/data/definitions/835.html
• MITRE ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
• Juniper Networks Security Advisories: https://supportportal.juniper.net/s/global-search/%40uri#advisories
• FIRST EPSS — CVE-2026-102185 status (not yet scored): https://api.first.org/data/v1/epss?cve=CVE-2026-102185

No CISA KEV listing, no public PoC/exploit code, and no known threat actor campaign or exploit-in-the-wild evidence is associated with CVE-2026-102185 in the available data.