CVE-2026-101942

Awaiting Analysis Awaiting Analysis - Queue

Improper Handling of Length Parameter Inconsistency in Juniper Junos OS

Publication date: 2026-10-14

Last updated on: 2026-10-18

Assigner: Juniper Networks, Inc.

Description

An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker to cause a denial of service via a malformed EVPN Type-3 or Type-4 route received from a configured EVPN peer and processed during re-advertisement.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-18

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-101942

EUVD

EUVD-2026-101320

Affected Vendors & Products

Vendor	Product	Version / Range
Juniper	Networks	Junos OS 0
Juniper	Networks	Junos OS 23.4
Juniper	Networks	Junos OS 24.2
Juniper	Networks	Junos OS 24.4
Juniper	Networks	Junos OS 25.2
Juniper	Networks	Junos OS 25.4
Juniper	Networks	Junos OS 26.2
Juniper	Networks	Junos OS Evolved 0
Juniper	Networks	Junos OS Evolved 23.4
Juniper	Networks	Junos OS Evolved 24.2
Juniper	Networks	Junos OS Evolved 24.4
Juniper	Networks	Junos OS Evolved 25.2
Juniper	Networks	Junos OS Evolved 25.4
Juniper	Networks	Junos OS Evolved 26.2
Juniper	Networks	Junos OS Evolved 23.4X100
Juniper	Networks	Junos OS Evolved 25.2X100
Juniper	Networks	Junos OS Evolved 25.4X300

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-130	The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.

Attack-Flow Graph

Executive Summary

This vulnerability is an Improper Handling of Length Parameter Inconsistency in Juniper Networks Junos OS and Junos OS Evolved routing protocol daemon (rpd). It allows an unauthenticated network-based attacker to cause a denial of service by sending a malformed EVPN Type-3 or Type-4 route from a configured EVPN peer during re-advertisement.

Detection Guidance

This vulnerability can be detected by monitoring for malformed EVPN Type-3 or Type-4 routes on Juniper devices. Check routing protocol logs for errors related to route processing or rpd crashes. Use commands like 'show log messages | match rpd' or 'show system processes extensive | match rpd' to identify issues.

Impact Analysis

The vulnerability can cause network disruptions by crashing the routing protocol daemon, leading to service outages. It may affect network availability and stability, especially in environments using EVPN for layer 2 or layer 3 services.

Compliance Impact

This vulnerability causes a denial of service via malformed EVPN routes, disrupting network availability. For GDPR, it may impact data processing continuity and availability of services handling personal data. For HIPAA, it could disrupt systems managing protected health information, potentially violating access and availability requirements.

Mitigation Strategies

Apply the latest Junos OS or Junos OS Evolved security patches from Juniper Networks to address the improper handling of EVPN Type-3 or Type-4 routes. Disable EVPN peer re-advertisement if not required and monitor for malformed route advertisements.

Hi! I’m here to help you understand CVE-2026-101942. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70