{"id":"CVE-2026-101980","state":"PUBLISHED","title":"Junos OS: Malformed Extended Echo requests cause a Routing Engine reboot when Extended Echo is enabled","description":"An Integer Underflow vulnerability in the kernel of Juniper Networks Junos OS with Extended Echo configured allows an unauthenticated, network-based attacker to cause a denial of service by a kernel crash.","publishedAt":"2026-10-14T16:17:50.040Z","updatedAt":"2026-10-14T20:46:21.554Z","severity":{"score":9.3,"label":"Critical","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L","source":"juniper"},"assigner":"juniper","products":["Juniper Networks Junos OS"],"affected":[{"vendor":"Juniper Networks","product":"Junos OS","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"23.2R2-S7.7","versionType":"custom"},{"version":"23.4","status":"affected","lessThan":"23.4R2-S8.13","versionType":"custom"},{"version":"24.2","status":"affected","lessThan":"24.2R2-S5.5","versionType":"custom"},{"version":"24.4","status":"affected","lessThan":"24.4R2-S5","versionType":"custom"},{"version":"25.2","status":"affected","lessThan":"25.2R2-S2","versionType":"custom"},{"version":"25.4","status":"affected","lessThan":"25.4R1-S3","versionType":"custom"},{"version":"26.2","status":"affected","lessThan":"26.2R1-S2","versionType":"custom"}]}],"references":["https://supportportal.juniper.net/JSA112188"],"weaknesses":["CWE-191"],"ingestedAt":"2026-10-29T20:10:13.529Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/101xxx/CVE-2026-101980.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-101980","state":"PUBLISHED","datePublished":"2026-10-14T16:17:50.040Z","dateUpdated":"2026-10-14T20:46:21.554Z","assignerShortName":"juniper","assignerOrgId":"8cbe9d5a-a066-4c94-8978-4b15efeae968","dateReserved":"2026-09-28T16:31:35.503Z"},"containers":{"cna":{"title":"Junos OS: Malformed Extended Echo requests cause a Routing Engine reboot when Extended Echo is enabled","descriptions":[{"lang":"en","value":"An Integer Underflow vulnerability in the kernel of Juniper Networks Junos OS with Extended Echo configured allows an unauthenticated, network-based attacker to cause a denial of service by a kernel crash."}],"affected":[{"vendor":"Juniper Networks","product":"Junos OS","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"23.2R2-S7.7","versionType":"custom"},{"version":"23.4","status":"affected","lessThan":"23.4R2-S8.13","versionType":"custom"},{"version":"24.2","status":"affected","lessThan":"24.2R2-S5.5","versionType":"custom"},{"version":"24.4","status":"affected","lessThan":"24.4R2-S5","versionType":"custom"},{"version":"25.2","status":"affected","lessThan":"25.2R2-S2","versionType":"custom"},{"version":"25.4","status":"affected","lessThan":"25.4R1-S3","versionType":"custom"},{"version":"26.2","status":"affected","lessThan":"26.2R1-S2","versionType":"custom"}]}],"references":[{"url":"https://supportportal.juniper.net/JSA112188","tags":["vendor-advisory"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]},{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":9.3,"baseSeverity":"CRITICAL","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-191","description":"CWE-191 Integer Underflow (Wrap or Wraparound)","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"juniper","orgId":"8cbe9d5a-a066-4c94-8978-4b15efeae968","dateUpdated":"2026-10-14T16:17:50.040Z"},"configurations":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<tt>[ system extended-echo ]</tt>"}],"value":"[ system extended-echo ]"}],"datePublic":"2026-10-14T16:00:00.000Z","exploits":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Juniper SIRT is not aware of any malicious exploitation of this vulnerability."}],"value":"Juniper SIRT is not aware of any malicious exploitation of this vulnerability."}],"solutions":[{"lang":"en","supportingMedia":[{"base64":true,"type":"text/html","value":"The following software releases have been updated to resolve this specific issue:<br>\n<br>\nJunos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1, and all subsequent releases.<br><br><b>Note:</b> For Junos OS releases 23.2, 23.4, and 24.2, specific respins have been referenced. Previously published versions of these releases have been rebuilt to resolve the security vulnerabilities identified in this advisory."}],"value":"The following software releases have been updated to resolve this specific issue:\n\n\n\nJunos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1, and all subsequent releases.\n\nNote: For Junos OS releases 23.2, 23.4, and 24.2, specific respins have been referenced. Previously published versions of these releases have been rebuilt to resolve the security vulnerabilities identified in this advisory."}],"source":{"advisory":"JSA112188","defect":["1954427"],"discovery":"INTERNAL"},"workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"There are no known workarounds for this issue."}],"value":"There are no known workarounds for this issue."}],"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-101980","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-14T20:36:30.599737Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-14T20:46:21.554Z"}}]}}}