Junos OS and Junos OS Evolved: Malformed OSPF packets cause rpd memory disclosure or service disruption when link-local TE processing is used
Impact
Junos OS and Junos OS Evolved versions less than 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, and 26.2R1-S2 are vulnerable to an improper validation of input, allowing an adjacent OSPF peer to disclose rpd memory or cause a service disruption. An attacker needs access to an adjacent OSPF peer. The weakness is due to improper validation of specified quantity in input.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.What to do
The following software releases have been updated to resolve this specific issue:
Junos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1, and all subsequent releases.
Junos OS Evolved: 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO, and all subsequent releases.
Note: For Junos OS releases 23.2, 23.4, and 24.2, and Junos OS Evolved releases 23.2-EVO, 23.4-EVO, and 24.2-EVO, specific respins have been referenced. Previously published versions of these releases have been rebuilt to resolve the security vulnerabilities identified in this advisory.
If OSPF packet processing on an enabled interface isn't needed, but it has just been configured so that it's added to the LSDB, ensure it's configured as 'passive': [ protocols ospf area <area> interface <interface> passive ]
The rpd crash only occurs with [ protocols ospf traceoptions flag lsa-update detail ] configured, so removing that line will prevent this.
Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
Juniper Networks · juniper
Junos OS
7 ranges
Juniper Networks · juniper
Junos OS
Compare with this publisher’s ranges. This does not inspect your installation.
affected
0 → before 23.2R2-S7.7
custom versions
23.4 → before 23.4R2-S8.13
custom versions
24.2 → before 24.2R2-S5.5
custom versions
24.4 → before 24.4R2-S5
custom versions
25.2 → before 25.2R2-S2
custom versions
25.4 → before 25.4R1-S3
custom versions
26.2 → before 26.2R1-S2
custom versions
Other versions: unaffected
Juniper Networks · juniper
Junos OS Evolved
10 ranges
Juniper Networks · juniper
Junos OS Evolved
Compare with this publisher’s ranges. This does not inspect your installation.
affected
0 → before 23.2R2-S7.7-EVO
custom versions
23.4 → before 23.4R2-S8.11-EVO
custom versions
24.2 → before 24.2R2-S5.6-EVO
custom versions
24.4 → before 24.4R2-S5-EVO
custom versions
25.2 → before 25.2R2-S2-EVO
custom versions
25.4 → before 25.4R1-S3-EVO
custom versions
26.2 → before 26.2R1-S2-EVO
custom versions
23.4X100
custom versions
25.2X100 → before 25.2X100-D35-EVO
custom versions
25.4X300 → before 25.4X300-D40-EVO
custom versions
Other versions: unaffected
Original source description
An Improper Validation of Specified Quantity in Input vulnerability in rpd of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent OSPF peer to disclose rpd memory or cause a rpd crash via a malformed OSPF packets.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-101974View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.