DEV Community

kozhevniko
kozhevniko

Posted on

CVE-2026-102178: BGP Flowspec Re-Advertisement Pushes a Stack Overflow Into the Junos Routing Engine

#cybersecurity #infosec #networking #security

CVE-2026-102178: BGP Flowspec Re-Advertisement Pushes a Stack Overflow Into the Junos Routing Engine

Flowspec was designed to let an operator distribute filters faster than a human can write them. CVE-2026-102178 abuses the re-advertisement half of that workflow: a peer sends a flowspec route, Junos selects it for redistribution, and the code that builds the outgoing update overflows a stack buffer in the BGP daemon.

Vulnerability overview

CVE-2026-102178 is a stack-based buffer overflow in the Border Gateway Protocol routing daemon of Juniper Networks Junos OS and Junos OS Evolved. NVD records a CVSS v3.1 base score of 9.8, a CVSS v4.0 base score of 9.3, and a publication date of 2026-10-14, published as part of the October 2026 Juniper bulletin and currently marked "Awaiting Analysis".
The vendor description states the outcome plainly: a configured BGP flowspec peer can cause routing-engine compromise or a routing-daemon denial of service when BGP update-threading is enabled.

Mechanism and exploitation conditions

Two configuration facts gate this flaw. The device must have a flowspec peer configured, and BGP update-threading must be enabled. Both are ordinary in service-provider and large enterprise environments where flowspec is used for rapid DDoS mitigation and where update-threading improves convergence under heavy churn.
When both conditions hold, the overflow is reached through a flowspec route that the device accepts and then re-advertises. The bug is therefore in the output path, not only in input validation: the daemon has already accepted the update and is now constructing a new one, which is why the vendor frames the trigger as re-advertisement. An attacker who controls, or has compromised, a flowspec peer can supply the crafted attribute without needing any credential on the target.
The scoring reflects the resulting severity rather than demonstrated exploitation. NVD's v4.0 vector lists the attack as network-reachable with no privileges required and a full impact on confidentiality, integrity and availability, and the v3.1 vector is the standard 9.8 combination. There is no claim in the public record that the flaw has been exploited in the wild, and CISA's Known Exploited Vulnerabilities catalog version 2026.10.23 does not list it.
The routing-engine compromise outcome is the important detail. A crash of the BGP daemon is disruptive but recoverable; compromise of the routing engine is a different class of incident, because the attacker gains control of the process that decides where traffic goes.

Impact

A compromised BGP daemon on a Junos device can alter the routing table, prefer attacker-controlled next hops, and blackhole or redirect specific prefixes. Because flowspec is often used to mitigate attacks, undermining it at the moment it matters most is an attractive objective: an adversary who can trigger a crash during a DDoS event converts a mitigation into an outage.
The denial-of-service path cascades through a fabric. Repeated BGP daemon failures reset sessions across many peers, and each reset floods the network with withdrawals and reannouncements. The blast radius is measured in neighbours, not in the single device.

Affected products and scope

Fixed builds for both platforms ship in the same October 2026 update. Junos OS is affected on all versions prior to 23.2R2-S7.7, 23.4 before 23.4R2-S8.13, 24.2 before 24.2R2-S5.5, 24.4 before 24.4R2-S5, 25.2 before 25.2R2-S2, 25.4 before 25.4R1-S3 and 26.2 before 26.2R1-S2.
Junos OS Evolved is affected on all versions prior to 23.2R2-S7.7-EVO, 23.4 before 23.4R2-S8.11-EVO, 24.2 before 24.2R2-S5.6-EVO, 24.4 before 24.4R2-S5-EVO, 25.2 before 25.2R2-S2-EVO, 25.4 before 25.4R1-S3-EVO, 26.2 before 26.2R1-S2-EVO, the 23.4X100-EVO branch, 25.2X100 before 25.2X100-D35-EVO and 25.4X300 before 25.4X300-D40-EVO.

Exposure context

A ZoomEye query for app="Juniper" returned 343,949 assets. That figure indicates how widely Juniper platforms are visible on the internet; it says nothing about which of them run flowspec or enable update-threading. Operational configuration, not scanner data, determines whether this CVE applies to a given device.

Remediation and validation

Upgrade to the fixed release for the deployed branch. If that cannot happen at once, restrict flowspec peers to the smallest set that genuinely needs to send updates, and reconsider whether update-threading needs to be enabled on devices that accept flowspec from parties outside the operator's trust boundary.
Validation should confirm the running release on every routing engine, review whether update-threading remains enabled, and check BGP daemon logs for unexpected restarts. For devices that carried untrusted flowspec adjacencies while unpatched, compare current route policy and installed flowspec filters against a known-good baseline, because a compromise of the routing engine is not visible from an upgrade confirmation alone.

References

Top comments (0)