CVSS 9.8: Juniper Junos BGP Buffer Overflow Enables Peer Control When Threading Active

A critical stack-based buffer overflow vulnerability exists in the Border Gateway Protocol routing daemon of Juniper Networks Junos OS and Junos OS Evolved. This flaw allows a configured BGP flowspec peer to compromise the routing engine or cause a denial of service.

The National Vulnerability Database rates CVE-2026-102178 as Critical with a CVSS score of 9.8. The weakness, identified as CWE-121, allows a configured BGP flowspec peer to cause routing-engine compromise or a routing-daemon denial of service. Exploitation occurs via flowspec route re-advertisement when BGP update-threading is enabled on the affected devices.

Technical context

The vulnerability stems from a stack-based buffer overflow in the BGP routing daemon. When a configured peer sends specific flowspec route updates, the system processes them via flowspec route re-advertisement. This results in a buffer overflow that can lead to routing-engine compromise or denial of service. The issue is present when BGP update-threading is enabled.

Affected systems

Juniper Networks identifies multiple versions of Junos OS and Junos OS Evolved as affected. Vulnerable versions include Junos OS before 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, and 24.4R2-S5. Junos OS Evolved versions before 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, and 24.4R2-S5-EVO are also at risk.

Defender's checklist

Organizations should immediately audit their Juniper network devices for the presence of BGP update-threading. If this feature is enabled, the risk of exploitation is significant. Teams must verify the current software version against the affected list provided by Juniper Networks. Prioritize patching or mitigating configurations on devices that face external BGP peers.

Operational impact

Network operations teams must assess whether their BGP configurations allow flowspec peers to interact with update-threading enabled devices. Security leaders should determine if any external peers have the potential to send malformed route advertisements. Incident response plans should include procedures for isolating compromised routing engines. Suppliers providing managed BGP services need to confirm their infrastructure is not using vulnerable Juniper software versions.

Background: Incident response plans

An incident response plan is a documented procedure for detecting, containing, and recovering from security breaches. It defines roles, communication channels, and technical steps to minimize damage, preserve evidence, and restore normal operations quickly.

Read the full guide: Incident Response Plans: Why Your Security Tools Fail Without One

What to do and how to stay safe: Juniper Networks

• Verify if BGP update-threading is enabled on all Juniper Junos OS and Junos OS Evolved devices.
• Check current software versions against the list of affected releases provided by Juniper Networks.
• Monitor BGP logs for unusual flowspec route re-advertisement activity from configured peers.
• Plan to apply vendor updates once they are available for your specific Junos version.

Step-by-step guide: Patch Management vs Vulnerability Management: The Critical Distinction

General security guidance from the InfoSec Ledger newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-102178?

The National Vulnerability Database rates CVE-2026-102178 as Critical with a CVSS score of 9.8.

Which Juniper products are affected by this vulnerability?

Juniper Networks Junos OS and Junos OS Evolved versions prior to specific service releases are affected.

How can an attacker exploit this flaw?

A configured BGP flowspec peer can cause routing-engine compromise or a routing-daemon denial of service via flowspec route re-advertisement when BGP update-threading is enabled.