{"id":"CVE-2026-102176","state":"PUBLISHED","title":"Junos OS: Specific packets cause SDK service crash or Routing Engine compromise when the SDK service and JDAF is enabled","description":"A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in the SDK service process of Juniper Networks Junos OS allows an unauthenticated network attacker to cause a denial of service or compromise the Routing Engine by sending specific packets when the SDK service and a JDAF routing instance are enabled.","publishedAt":"2026-10-14T16:56:42.641Z","updatedAt":"2026-10-16T16:36:09.763Z","severity":{"score":8.7,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M","source":"juniper"},"assigner":"juniper","products":["Juniper Networks Junos OS"],"affected":[{"vendor":"Juniper Networks","product":"Junos OS","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"23.2R2-S7.7","versionType":"custom"},{"version":"23.4","status":"affected","lessThan":"23.4R2-S8.13","versionType":"custom"},{"version":"24.2","status":"affected","lessThan":"24.2R2-S5.5","versionType":"custom"},{"version":"24.4","status":"affected","lessThan":"24.4R2-S5","versionType":"custom"},{"version":"25.2","status":"affected","lessThan":"25.2R2-S2","versionType":"custom"},{"version":"25.4","status":"affected","lessThan":"25.4R1-S3","versionType":"custom"},{"version":"26.2","status":"affected","lessThan":"26.2R1-S2","versionType":"custom"}]}],"references":["https://supportportal.juniper.net/JSA112188"],"weaknesses":["CWE-120"],"ingestedAt":"2026-10-29T20:10:13.529Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/102xxx/CVE-2026-102176.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-102176","state":"PUBLISHED","datePublished":"2026-10-14T16:56:42.641Z","dateUpdated":"2026-10-16T16:36:09.763Z","assignerShortName":"juniper","assignerOrgId":"8cbe9d5a-a066-4c94-8978-4b15efeae968","dateReserved":"2026-09-28T18:17:13.470Z"},"containers":{"cna":{"title":"Junos OS: Specific packets cause SDK service crash or Routing Engine compromise when the SDK service and JDAF is enabled","descriptions":[{"lang":"en","value":"A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in the SDK service process of Juniper Networks Junos OS allows an unauthenticated network attacker to cause a denial of service or compromise the Routing Engine by sending specific packets when the SDK service and a JDAF routing instance are enabled."}],"affected":[{"vendor":"Juniper Networks","product":"Junos OS","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"23.2R2-S7.7","versionType":"custom"},{"version":"23.4","status":"affected","lessThan":"23.4R2-S8.13","versionType":"custom"},{"version":"24.2","status":"affected","lessThan":"24.2R2-S5.5","versionType":"custom"},{"version":"24.4","status":"affected","lessThan":"24.4R2-S5","versionType":"custom"},{"version":"25.2","status":"affected","lessThan":"25.2R2-S2","versionType":"custom"},{"version":"25.4","status":"affected","lessThan":"25.4R1-S3","versionType":"custom"},{"version":"26.2","status":"affected","lessThan":"26.2R1-S2","versionType":"custom"}]}],"references":[{"url":"https://supportportal.juniper.net/JSA112188","tags":["vendor-advisory"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]},{"cvssV4_0":{"Automatable":"YES","Recovery":"AUTOMATIC","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","baseScore":8.7,"baseSeverity":"HIGH","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"CONCENTRATED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"MODERATE"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-120","description":"CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"juniper","orgId":"8cbe9d5a-a066-4c94-8978-4b15efeae968","dateUpdated":"2026-10-14T16:56:42.641Z"},"configurations":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<tt>[ system processes sdk-service enable ]<br>[ services jdaf routing-instances default ]<br><br></tt>"}],"value":"[ system processes sdk-service enable ]\n[ services jdaf routing-instances default ]"}],"datePublic":"2026-10-14T16:00:00.000Z","exploits":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Juniper SIRT is not aware of any malicious exploitation of this vulnerability."}],"value":"Juniper SIRT is not aware of any malicious exploitation of this vulnerability."}],"solutions":[{"lang":"en","supportingMedia":[{"base64":true,"type":"text/html","value":"The following software releases have been updated to resolve this specific issue:<br>\n<br>\nJunos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1, and all subsequent releases.<br><br><b>Note:</b> For Junos OS releases 23.2, 23.4, and 24.2, specific respins have been referenced. Previously published versions of these releases have been rebuilt to resolve the security vulnerabilities identified in this advisory."}],"value":"The following software releases have been updated to resolve this specific issue:\n\n\n\nJunos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1, and all subsequent releases.\n\nNote: For Junos OS releases 23.2, 23.4, and 24.2, specific respins have been referenced. Previously published versions of these releases have been rebuilt to resolve the security vulnerabilities identified in this advisory."}],"source":{"advisory":"JSA112188","defect":["1951698"],"discovery":"INTERNAL"},"workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Disable&nbsp;sdk-service if it is not required."}],"value":"Disable sdk-service if it is not required."}],"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-10-16T16:35:55.790852Z","id":"CVE-2026-102176","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-16T16:36:09.763Z"}}]}}}