On October 14, 2026, NVD published two Juniper Networks CVEs rated 9.8: CVE-2026-101950, a heap overflow in the Secure Vector Routing (SVR) component of Junos OS on SRX, and CVE-2026-102178, a stack overflow in the BGP routing daemon of Junos OS and Junos OS Evolved, tied to flowspec.
What they share: each only applies to a specific feature. If you don't use it, the simplest mitigation is not having it enabled.
| CVE | Product | Component | CVSS | Vector | NVD published |
|---|---|---|---|---|---|
| CVE-2026-101950 | Junos OS on SRX | SVR | 9.8 | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | 2026-10-14 |
| CVE-2026-102178 | Junos OS, Junos OS Evolved | BGP (flowspec) | 9.8 | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | 2026-10-14 |
Neither is in the CISA KEV catalog as of writing.
Junos OS on SRX: CVE-2026-101950 (SVR)
A Heap-based Buffer Overflow vulnerability in the SVR component of Juniper Networks Junos OS on SRX Series allows an unauthenticated network attacker to cause a denial of service and potentially compromise confidentiality and integrity [...]
An unauthenticated attacker sends malformed IPv4 packets to an interface configured for Secure Vector Routing. The heap overflow causes at least a denial of service on the firewall, and potentially a confidentiality and integrity compromise.
Why it matters
An SRX is an edge firewall: its interfaces take traffic from the internet. If SVR is configured on a reachable interface, no authentication stands in the way. A firewall going down means a site outage; a firewall with corrupted memory is worse.
Exposure
Only SRX devices with SVR configured on an interface fit this scenario. Check each device's configuration rather than assuming.
Mitigation
- Apply the fixed Junos OS release listed in the relevant JSA bulletin.
- If you don't use SVR: make sure it isn't configured on any interface.
- If you need SVR: where possible, restrict where traffic reaching SVR interfaces can come from.
Junos OS and Junos OS Evolved: CVE-2026-102178 (BGP flowspec)
A Stack-based Buffer Overflow vulnerability in the BGP routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP flowspec peer to cause routing-engine compromise or a routing-daemon denial of service [...]
The flaw triggers during flowspec route re-advertisement when BGP update-threading is enabled. The source is a configured BGP flowspec peer. Impact: routing daemon denial of service, or routing engine compromise.
Why it matters
The score is 9.8 with PR:N, but the real access condition is being a configured BGP peer — or controlling one, or an upstream device that propagates flowspec routes. At carriers and transit providers, flowspec sessions with third parties aren't rare, and flowspec exists precisely to push filtering rules from one network to another.
Compromising the routing engine means owning the router's control plane: routing tables, sessions with other peers, and so the traffic crossing the network.
Exposure
You need both: flowspec enabled in BGP and update-threading enabled. A router missing either one doesn't fit this scenario.
Mitigation
- Apply the fixed release listed in the JSA bulletin for Junos OS and Junos OS Evolved.
- If you don't use flowspec: remove it from the negotiated BGP address families.
- If you don't need update-threading: consider disabling it until you patch, checking the impact on convergence performance.
- Limit flowspec peers to the ones you actually need, and filter received flowspec routes.
Versions
NVD publishes no affected or fixed versions for these two CVEs as of writing. Fixed releases are in Juniper's security bulletins (JSA) — check them for your Junos OS or Junos OS Evolved branch.
Detection
- Restarts or crashes of the routing daemon or data plane, and generated core files
- BGP sessions flapping unusually, especially with flowspec peers
- Unexpected flowspec routes or abnormal volumes of them
- Logins or commands on the routing engine with no documented change
Why Monitor Your Network Devices
Junos CVEs often arrive in batches, and each depends on a specific feature. Knowing which features you run, on which devices and in which release, is what lets you triage in minutes instead of days.
With cveo.tech, inventory your Juniper routers and firewalls with exact Junos versions, and get alerted whenever a critical CVE affects them.