CVE-2026-33795

Executive Summary

CVE-2026-33795 is a numeric truncation error (CWE-197) in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. An unauthenticated, network-based attacker can trigger a denial-of-service condition by sending a crafted BGP Prefix-SID route advertisement that is subsequently re-advertised by the affected device. The vulnerability affects Junos OS and Junos OS Evolved versions 20.4R1 and later, with no vendor patch currently available.

Technical Analysis

The vulnerability resides in the rpd process, which handles routing protocols including BGP. The flaw is classified as a numeric truncation error (CWE-197), meaning a value is converted to a smaller data type, causing loss of information or an unexpected value that is not properly validated. In the context of BGP Prefix-SID route advertisements, the truncation likely occurs when processing or re-advertising attribute data, leading to a state that disrupts the rpd process.

The attack surface is the BGP control plane. BGP speakers exchange route advertisements, and a Prefix-SID attribute is used to signal Segment Routing over MPLS (SR-MPLS) or SRv6 SID information. An attacker who can establish a BGP session or inject routes into an existing session can send a specially crafted Prefix-SID route advertisement. The "subsequently re-advertised" condition indicates that the malformed route is propagated to other BGP peers, amplifying the impact across the routing domain.

Because the vulnerability is triggered by a network-based, unauthenticated attacker, the attack does not require valid credentials but does require the ability to send BGP messages to the target. This can be achieved by a directly connected peer, a route reflector client, or an attacker who has compromised a BGP-speaking device. The numeric truncation error likely causes the rpd process to crash or become unresponsive, resulting in a denial of service for routing functions.

The NVD description does not provide specific function names, file paths, or code-level details. The analysis is therefore limited to the vulnerability class and the BGP Prefix-SID attack vector.

Exploitation Scenarios

No public proof-of-concept (PoC) or exploit code is available. The attack chain is inferred from the vulnerability class and the NVD description.

1. Reconnaissance/target identification: The attacker identifies a Juniper Networks device running Junos OS or Junos OS Evolved 20.4R1 or later that participates in BGP routing. This can be done by scanning for BGP port 179, using Shodan dorks such as product:"Junos", or by leveraging existing network topology knowledge.

2. Triggering the flaw: The attacker establishes or hijacks a BGP session with the target, or injects routes into an existing BGP session. The attacker then sends a BGP UPDATE message containing a Prefix-SID attribute with a value crafted to trigger a numeric truncation error during processing or re-advertisement. The exact malformed value is not specified in the NVD description, but it is designed to cause the rpd process to mishandle the attribute.

3. Payload/execution method: The payload is a BGP UPDATE message with a Prefix-SID attribute. The vulnerability is triggered when the target processes the attribute and subsequently re-advertises it to other peers. The re-advertisement step is critical, as it indicates the malformed data is propagated, potentially causing a cascade of failures across the routing infrastructure.

4. Post-exploitation impact: Successful exploitation results in a denial-of-service condition affecting the rpd process. This can lead to loss of routing information, BGP session resets, and network instability. Because the malformed route is re-advertised, other Juniper devices in the routing domain may also be affected, amplifying the impact. The attacker does not gain code execution or access to sensitive data; the impact is limited to availability.

Impact Assessment

The CVSS v3.1 base score is 7.5 (High), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. This indicates:

• Attack Vector (AV:N): Exploitable from the network.
• Attack Complexity (AC:L): No special conditions required; the attack is straightforward once a BGP session is established or injected into.
• Privileges Required (PR:N): No authentication needed.
• User Interaction (UI:N): No user action required.
• Scope (S:U): The impact is confined to the vulnerable component.
• Confidentiality (C:N): No data exposure.
• Integrity (I:N): No data modification.
• Availability (A:H): High impact on availability, as the rpd process can be crashed or made unresponsive.

The blast radius includes any Juniper device running Junos OS or Junos OS Evolved 20.4R1 or later that processes and re-advertises BGP Prefix-SID routes. In a service provider or large enterprise network, a single malformed advertisement could propagate to multiple routers, causing widespread routing outages. The business impact is severe for organizations relying on BGP for critical connectivity, as denial of service can lead to network downtime, loss of revenue, and SLA violations.

Detection Guidance

Sigma Rule

title: Juniper Junos rpd Numeric Truncation DoS via BGP Prefix-SID
id: 8f1c2e3a-4b5d-6c7e-8f9a-0b1c2d3e4f5a
status: experimental
description: Detects potential exploitation of CVE-2026-33795 through BGP Prefix-SID route advertisements causing rpd process disruption.
author: Threat Intelligence Team
date: 2026-01-01
logsource:
  product: juniper
  service: junos
  category: bgp
detection:
  selection:
    - "rpd.*Prefix-SID.*truncation"
    - "BGP.*UPDATE.*Prefix-SID.*error"
    - "rpd.*core.*dump"
    - "rpd.*restart"
  condition: selection
falsepositives:
  - Legitimate BGP Prefix-SID advertisements with unusual but valid attributes
  - Software bugs unrelated to exploitation
level: high
tags:
  - attack.t1499
  - cve.2026.33795

YARA Rule

rule CVE_2026_33795_Juniper_rpd_Prefix_SID_DoS
{
    meta:
        description = "Detects BGP Prefix-SID attribute patterns associated with CVE-2026-33795"
        author = "Threat Intelligence Team"
        date = "2026-01-01"
        cve = "CVE-2026-33795"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-33795"
    strings:
        $prefix_sid = { 1E 00 ?? ?? ?? ?? ?? ?? ?? ?? } // BGP Prefix-SID attribute type 0x1E
        $bgp_update = { FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 00 02 } // BGP UPDATE marker and type
    condition:
        $bgp_update and $prefix_sid
}

Suricata IDS Rule

alert tcp any any -> any 179 (msg:"CVE-2026-33795 Juniper Junos rpd BGP Prefix-SID Numeric Truncation DoS Attempt"; flow:to_server,established; content:"|FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF|"; content:"|02|"; offset:18; depth:1; content:"|1E|"; distance:0; within:10; reference:cve,2026-33795; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-33795; classtype:attempted-dos; sid:10000001; rev:1;)

Elastic Detection

process where event.type == "start" and process.name == "rpd" and
  (process.command_line like~ "*Prefix-SID*" or process.command_line like~ "*truncation*") and
  event.outcome == "crash"

Splunk SPL Query

index=junos sourcetype=junos:bgp
| search "rpd" "Prefix-SID" ("truncation" OR "error" OR "core dump" OR "restart")
| stats count by host, src_ip, dest_ip, message
| where count > 0

Wazuh OSSEC Rule

<group name="junos,bgp,">
  <rule id="100100" level="12">
    <decoded_as>json</decoded_as>
    <field name="program">rpd</field>
    <field name="message">Prefix-SID.*truncation|core dump|restart</field>
    <description>CVE-2026-33795: Possible Juniper Junos rpd DoS via BGP Prefix-SID</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>cve_2026_33795,denial_of_service,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Restrict BGP peering to trusted, authenticated peers using TCP MD5 or BGPsec where possible.
   • Apply inbound and outbound route filters (prefix lists, AS path filters) to limit the propagation of unexpected Prefix-SID attributes.
   • Disable Prefix-SID processing if not required, or ensure that only trusted peers can send Prefix-SID attributes.
   • Monitor rpd process health and configure automatic restart of the routing process if supported.
   • Implement rate limiting on BGP UPDATE messages.

2. Patch/upgrade steps:

   • No vendor patch is currently available. Monitor Juniper Networks security advisories for updates.
   • Once a patch is released, upgrade to the fixed Junos OS or Junos OS Evolved version.
   • Prior to patching, consider isolating affected devices or applying compensating controls.

3. Long-term hardening:

   • Implement BGP route origin validation (RPKI) and route leak prevention.
   • Use out-of-band management and restrict BGP access to authorized networks.
   • Deploy network segmentation to limit the blast radius of routing protocol attacks.
   • Regularly audit BGP configurations and apply the principle of least privilege to routing peers.
   • Enable logging and monitoring for BGP anomalies and rpd process crashes.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-33795
• Juniper Networks Security Advisories: https://supportportal.juniper.net/s/global-search/%40uri#q=CVE-2026-33795
• CWE-197: Numeric Truncation Error: https://cwe.mitre.org/data/definitions/197.html
• MITRE ATT&CK T1499: Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
• CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (not listed as of report date)