A stack-based buffer overflow in the BGP routing daemon of Junos OS and Junos OS Evolved could allow a configured BGP flowspec peer to crash the routing daemon or potentially compromise the routing engine on devices with BGP update-threading enabled.
What Is It
CVE-2026-102178 is a stack-based buffer overflow (CWE-121) in the BGP routing daemon of Juniper Networks Junos OS and Junos OS Evolved. Juniper SIRT disclosed it, and NVD published it on 2026-10-14. NVD's status for the record is still "Received."
The flaw is triggered by flowspec route re-advertisement. It can only be reached when BGP update-threading is enabled. The vendor description says the attacker is a configured BGP flowspec peer.
Why It Matters
- CVSS 3.1: 9.8 Critical (
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) - CVSS 4.0: 9.3 Critical. It is marked Automatable, with Recovery: Automatic.
According to the vendor's description, the worst case is compromise of the routing engine. The more limited outcome is a denial of service of the routing daemon. Either one would disrupt routing on networks that depend on BGP. The attack also requires an established flowspec peering session. That narrows who can trigger it, even though the CVSS vector scores it as requiring no privileges.
Exploitation status: As of 2026-10-14, CVE-2026-102178 is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. Active exploitation has not been publicly confirmed.
What's Vulnerable
Junos OS: - All versions before 23.2R2-S7.7 - 23.4 before 23.4R2-S8.13 - 24.2 before 24.2R2-S5.5 - 24.4 before 24.4R2-S5 - 25.2 before 25.2R2-S2 - 25.4 before 25.4R1-S3 - 26.2 before 26.2R1-S2
Junos OS Evolved: - All versions before 23.2R2-S7.7-EVO - 23.4 before 23.4R2-S8.11-EVO - 24.2 before 24.2R2-S5.6-EVO - 24.4 before 24.4R2-S5-EVO - 25.2 before 25.2R2-S2-EVO - 25.4 before 25.4R1-S3-EVO - 26.2 before 26.2R1-S2-EVO - 23.4X100 (no fixed version listed) - 25.2X100 before 25.2X100-D35-EVO - 25.4X300 before 25.4X300-D40-EVO
A device is only exposed if it also has the vulnerable configuration: a BGP flowspec peer with BGP update-threading enabled.
Patch Status
Based on the affected-version ranges, fixes should be available at the versions listed above, for example 23.4R2-S8.13, 24.4R2-S5, 25.4R1-S3-EVO and 26.2R1-S2-EVO. The NVD record lists no fixed version for the Junos OS Evolved 23.4X100 train.
The CVE is not in the KEV catalog, so no CISA required action or remediation due date applies. Administrators should check Juniper advisory JSA112187 for the authoritative fixed releases and any workarounds. They should also confirm whether their devices run BGP flowspec with update-threading enabled.