Juniper Junos Stack Buffer Overflow in BGP Daemon Allows Peer Compromise or Denial of Service

A flaw in Juniper Networks’ BGP flowspec processing allows attackers to crash the system or take control of the routing engine. Security researchers identified this stack-based buffer overflow, which resides within the BGP routing daemon. The vulnerability affects both standard Junos OS and the newer Junos OS Evolved platforms. It is rated critical by the National Vulnerability Database, with a CVSS score of 9.8.

Root cause

The issue stems from how the software handles specific data inputs. When the system processes flowspec route re-advertisements, it fails to correctly manage memory boundaries. This oversight creates a stack-based buffer overflow, a common weakness where excess data overwrites adjacent memory space. The National Vulnerability Database links this flaw to CWE-121, which describes stack-based buffer overflows. This technical error allows an attacker to execute arbitrary code or crash the service.

Attack path

An attacker must first be a configured BGP flowspec peer to exploit this vulnerability. Once connected, the adversary can trigger the flaw by sending malicious flowspec route re-advertisements. This action is only effective if BGP update-threading is enabled on the target device. Successful exploitation can lead to a complete compromise of the routing engine. Alternatively, the attack may result in a denial of service for the routing daemon, disrupting network traffic.

Affected versions

Multiple versions of Juniper’s operating systems are vulnerable to this issue. Affected releases include Junos OS versions prior to 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, and 24.4R2-S5. Junos OS Evolved is also impacted in versions before 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, and 24.4R2-S5-EVO. Users running these specific builds or earlier are exposed to the risk.

Mitigation

• Check your current Junos OS or Junos OS Evolved version against the affected list.
• Verify if BGP update-threading is enabled on your routing devices.
• Review BGP flowspec peer configurations to identify potential exposure.
• Plan to upgrade to the patched versions listed in the advisory.

Why it matters

Buffer overflows remain a primary vector for remote code execution in network devices. For non-specialists, understanding that this flaw requires a pre-existing trust relationship is key. The attacker must already be a configured peer, which limits immediate widespread exploitation. However, the high severity rating indicates that once access is gained, the impact is severe. Teams usually prioritise patching critical flaws in routing infrastructure to maintain network stability and prevent lateral movement.

Background: National Vulnerability Database

The National Vulnerability Database provides standard identifiers for software flaws. You use these identifiers to automate patching and verify vendor claims. Small teams should cross-reference database entries with their IT asset inventory to prioritise fixes and avoid wasting time on irrelevant alerts.

Read the full guide: National Vulnerability Database: Small Business Action Plan

What to do and how to stay safe: Juniper Networks

• Audit your BGP configurations to ensure only trusted peers are established.
• Monitor system logs for unusual flowspec route re-advertisement activity.
• Disable BGP update-threading if it is not required for your network operations.
• Apply vendor updates as soon as they become available for your platform.

Step-by-step guide: Lateral Movement Response: Containment, Recovery and Prevention Steps

General security guidance from the Vector Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-102178?

The National Vulnerability Database rates the vulnerability as critical with a CVSS score of 9.8.

Does this vulnerability require authentication to exploit?

Yes, the attacker must be a configured BGP flowspec peer to trigger the flaw.

Which Juniper operating systems are affected by this bug?

Both Junos OS and Junos OS Evolved are affected in specific versions prior to the listed patches.