CVE-2026-101942 is a High (CVSS 7.5) length handling flaw in the rpd process of Junos OS and Junos OS Evolved. A malformed EVPN Type-3 or Type-4 route from a configured EVPN peer can cause a denial of service when it is re-advertised. Check JSA112187 for fixed releases.
What's affected
The weakness is CWE-130 (improper handling of length parameter inconsistency). The record says an unauthenticated, network based attacker can cause a denial of service through a malformed EVPN Type-3 or Type-4 route, received from a configured EVPN peer and processed during re-advertisement.
EVPN Type-3 routes announce inclusive multicast information, and Type-4 routes carry Ethernet segment information. Both are part of the control plane of EVPN overlays used in data centre and metro Ethernet networks. The description says the crash happens in the routing protocol daemon when such a route is processed for re-advertisement.
The record lists no versions. The only reference is bulletin JSA112187, which also covers CVE-2026-101940, CVE-2026-101941 and CVE-2026-101943. We could not read Juniper's support portal, so we cannot confirm affected or fixed releases. Read the bulletin table for your platform.
The vector is network, low complexity, no privileges, no interaction, with high impact on availability. Unlike two of the other entries in the bulletin, the record names no special configuration beyond EVPN peering, so any router that runs EVPN with BGP peers is a candidate.
How to check if you're exposed
Check the version and compare it with the bulletin.
show version
Then check whether EVPN is in use and which peers send you routes.
show evpn instance
show bgp summary
If you do not run EVPN, this CVE is not described as applying to you. If you do, list the EVPN peers and decide which are outside your own administrative control, such as providers or partner networks. Those peers are the most important to review.
The free in-browser dependency scan at gold.safeguard.sh/scan can match a lockfile or manifest against known CVEs without installing anything. The Gold directory page for each CVE lists affected packages and fixes as they are published.
What to do now
- Read JSA112187 and note the fixed releases for your platform.
- Inventory routers with EVPN configured and the peers they exchange EVPN routes with.
- Upgrade to a fixed release in your next maintenance window, starting with routers that peer outside your own control.
- Authenticate BGP sessions and apply route filters to EVPN peers where your design allows.
- Monitor for rpd crashes and core files, and open a Juniper support case if you see one.
Why it matters
Length fields in protocol messages must agree with the data that follows. When code trusts a length without checking, the result may be a read past the end of a buffer or a crash. Control plane code is especially sensitive, since a crash drops routing state for every service on the device.
The sender must be a configured peer, so a trusted peer with a bug or a hijacked session could trigger it. The record does not mark the CVE as known exploited.
Quick check
Does this need a special configuration?
The record names EVPN peering and the processing of EVPN Type-3 or Type-4 routes. It lists no other condition.
Where are the affected versions?
In JSA112187. We could not read the tables, so check the bulletin for your platform.
Sources
Last reviewed: 18 October 2026.
