CVE-2026-101991

Awaiting Analysis Awaiting Analysis - Queue

Improper Handling of Length Parameter Inconsistency in Juniper Junos OS

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: Juniper Networks, Inc.

Description

An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP-LS peer to cause heap data disclosure via a malformed UPDATE sent over a session with the traffic-engineering address family enabled.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-101991

EUVD

EUVD-2026-101451

Affected Vendors & Products

Vendor	Product	Version / Range
Juniper	Networks	Junos OS 0
Juniper	Networks	Junos OS 23.4
Juniper	Networks	Junos OS 24.2
Juniper	Networks	Junos OS 24.4
Juniper	Networks	Junos OS 25.2
Juniper	Networks	Junos OS 25.4
Juniper	Networks	Junos OS 26.2
Juniper	Networks	Junos OS Evolved 0
Juniper	Networks	Junos OS Evolved 23.4
Juniper	Networks	Junos OS Evolved 24.2
Juniper	Networks	Junos OS Evolved 24.4
Juniper	Networks	Junos OS Evolved 25.2
Juniper	Networks	Junos OS Evolved 25.4
Juniper	Networks	Junos OS Evolved 26.2
Juniper	Networks	Junos OS Evolved 23.4X100
Juniper	Networks	Junos OS Evolved 25.2X100
Juniper	Networks	Junos OS Evolved 25.4X300

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-130	The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.

Attack-Flow Graph

Executive Summary

This vulnerability involves improper handling of length parameters in Juniper Networks Junos OS and Junos OS Evolved routing protocol daemon (rpd). A configured BGP-LS peer can exploit a malformed UPDATE message sent over a session with the traffic-engineering address family enabled to cause heap data disclosure.

Detection Guidance

This vulnerability involves a malformed UPDATE message sent over a BGP-LS session with traffic-engineering address family enabled. Detection requires monitoring BGP-LS UPDATE messages for malformed length parameters. Check Junos OS logs for rpd crashes or heap-related errors. Use 'show log messages | match rpd' to inspect routing daemon logs for anomalies.

Impact Analysis

An attacker could exploit this to access sensitive heap memory data, potentially leading to information disclosure. This may include internal system data or other confidential information processed by the routing daemon.

Compliance Impact

This vulnerability could lead to unauthorized data disclosure, which may violate compliance requirements under GDPR or HIPAA if sensitive data is exposed. Organizations must address this to maintain regulatory compliance.

Mitigation Strategies

Disable the traffic-engineering address family on BGP-LS peers to prevent exploitation. Update Junos OS or Junos OS Evolved to the latest patched version as soon as possible.

Hi! I’m here to help you understand CVE-2026-101991. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70