CVE-2026-101943 is a High (CVSS 7.5) improper input validation flaw in the rpd routing daemon of Junos OS and Junos OS Evolved. An unauthenticated network attacker can cause a denial of service with a crafted BGP EVPN update message. Review Juniper bulletin JSA112187 and upgrade to a fixed release.
What's affected
The weakness is CWE-20 (improper input validation). The record says an unauthenticated, network based attacker can cause a denial of service via a crafted BGP EVPN update message. Junos OS and Junos OS Evolved are both named.
This is the fourth entry in the same Juniper bulletin, after CVE-2026-101940, CVE-2026-101941 and CVE-2026-101942. The record is the thinnest of the four. It names no configuration condition and no message field, and it gives no version list. Its only reference is JSA112187. We could not load the Juniper support portal, so we cannot add affected or fixed versions. Please read the bulletin.
The vector is network, low complexity, no privileges and no user interaction, with high impact on availability and none on confidentiality or integrity. The record describes the attacker as unauthenticated and network based. BGP sessions are normally between configured peers, so in practice the sender is a peer or someone who can take over a peer session.
How to check if you're exposed
Get the version and compare it with the bulletin.
show version
Then check whether the router carries EVPN routes over BGP.
show bgp summary
show route table bgp.evpn.0 summary
If you have no EVPN address family on any BGP session, the record's condition, an EVPN update message, does not arise. If you do, list the peers and note which ones belong to other organisations.
Since four entries share one bulletin, check them together. A single upgrade to a release that the bulletin lists as fixed for all four is easier to manage than four separate changes.
The free in-browser dependency scan at gold.safeguard.sh/scan can match a lockfile or manifest against known CVEs without installing anything. The Gold directory page for each CVE lists affected packages and fixes as they are published.
What to do now
- Read JSA112187 and map the fixed releases to your platforms.
- Plan one upgrade that covers all four CVEs in the bulletin.
- Identify EVPN BGP sessions with peers outside your control and review their authentication and filters.
- Alert on rpd restarts and crash files.
- Keep a record of the software version of each router before and after the change.
Why it matters
Input validation flaws in routing daemons are about availability. A crafted update that was not anticipated by the parser is enough to stop the process. Because BGP and EVPN carry reachability for whole networks, a restart is felt well beyond the one router.
The record does not mark the CVE as known exploited, and we found no report of exploitation. The right posture is routine, well planned patching, with extra attention to routers that talk to external peers.
Quick check
Is there a workaround?
The record does not list one. Check bulletin JSA112187 for any mitigation Juniper provides.
Why are four Junos CVEs published together?
They share one Juniper bulletin, JSA112187, which is the only reference in each record. They affect the same daemon but have different triggers.
Sources
Last reviewed: 18 October 2026.
