Junos OS Evolved: The IPv6 BGP session will flap due to receipt of a specific IPv6 packet
Priority LOW 34CWE-665Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
On Juniper Networks Junos OS Evolved devices, receipt of a specific IPv6 packet may cause an established IPv6 BGP session to terminate, creating a Denial of Service (DoS) condition. Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition. This issue does not affect IPv4 BGP sessions. This issue affects IBGP or EBGP peer sessions with IPv6. This issue affects: Juniper Networks Junos OS Evolved: 19.4 versions prior to 19.4R2-S3-EVO; 20.1 versions prior to 20.1R2-S3-EVO; 20.2 versions prior to 20.2R2-S1-EVO; 20.3 versions prior to 20.3R2-EVO. This issue does not affect Juniper Networks Junos OS releases.
Why it matters now
EPSS 0.00876 59th percentileScored 2026-11-07
Fix Fixed Junos OS Evolved (Juniper Networks): 19.4R2-S3-EVO, 20.1R2-S3-EVO, 20.2R2-S1-EVO +1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Juniper | Junos OS Evolved | 19.4-EVO to before 19.4R2-S3-EVO; 20.1-EVO to before 20.1R2-S3-EVO; 20.2-EVO to before 20.2R2-S1-EVO; 20.3-EVO to before 20.3R2-EVO | 19.4R2-S3-EVO, 20.1R2-S3-EVO, 20.2R2-S1-EVO, 20.3R2-EVO | Patch available | CNA |
- Junos OS Evolved VendorJuniper Affected 19.4-EVO to before 19.4R2-S3-EVO; 20.1-EVO to before 20.1R2-S3-EVO; 20.2-EVO to before 20.2R2-S1-EVO; 20.3-EVO to before 20.3R2-EVO Fixed in 19.4R2-S3-EVO, 20.1R2-S3-EVO, 20.2R2-S1-EVO, 20.3R2-EVO Patch available CNA
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:juniper:junos_os_evolved:20.1:r1:*:*:*:*:*:* | 20.1 r1 | Vulnerable | Juniper |
| cpe:2.3:o:juniper:junos_os_evolved:20.1:r1-s1:*:*:*:*:*:* | 20.1 r1-s1 | Vulnerable | Juniper |
| cpe:2.3:o:juniper:junos_os_evolved:20.1:r2:*:*:*:*:*:* | 20.1 r2 | Vulnerable | Juniper |
| cpe:2.3:o:juniper:junos_os_evolved:20.1:r2-s1:*:*:*:*:*:* | 20.1 r2-s1 | Vulnerable | Juniper |
| cpe:2.3:o:juniper:junos_os_evolved:20.1:r2-s2:*:*:*:*:*:* | 20.1 r2-s2 | Vulnerable | Juniper |
| cpe:2.3:o:juniper:junos_os_evolved:20.2:r1:*:*:*:*:*:* | 20.2 r1 | Vulnerable | Juniper |
| cpe:2.3:o:juniper:junos_os_evolved:20.2:r1-s1:*:*:*:*:*:* | 20.2 r1-s1 | Vulnerable | Juniper |
| cpe:2.3:o:juniper:junos_os_evolved:20.2:r2:*:*:*:*:*:* | 20.2 r2 | Vulnerable | Juniper |
| cpe:2.3:o:juniper:junos_os_evolved:20.3:r1:*:*:*:*:*:* | 20.3 r1 | Vulnerable | Juniper |
| cpe:2.3:o:juniper:junos_os_evolved:20.3:r1-s1:*:*:*:*:*:* | 20.3 r1-s1 | Vulnerable | Juniper |
- cpe:2.3:o:juniper:junos_os_evolved:20.1:r1:*:*:*:*:*:* Versions 20.1 r1 Vulnerable ·Juniper
- cpe:2.3:o:juniper:junos_os_evolved:20.1:r1-s1:*:*:*:*:*:* Versions 20.1 r1-s1 Vulnerable ·Juniper
- cpe:2.3:o:juniper:junos_os_evolved:20.1:r2:*:*:*:*:*:* Versions 20.1 r2 Vulnerable ·Juniper
- cpe:2.3:o:juniper:junos_os_evolved:20.1:r2-s1:*:*:*:*:*:* Versions 20.1 r2-s1 Vulnerable ·Juniper
- cpe:2.3:o:juniper:junos_os_evolved:20.1:r2-s2:*:*:*:*:*:* Versions 20.1 r2-s2 Vulnerable ·Juniper
- cpe:2.3:o:juniper:junos_os_evolved:20.2:r1:*:*:*:*:*:* Versions 20.2 r1 Vulnerable ·Juniper
- cpe:2.3:o:juniper:junos_os_evolved:20.2:r1-s1:*:*:*:*:*:* Versions 20.2 r1-s1 Vulnerable ·Juniper
- cpe:2.3:o:juniper:junos_os_evolved:20.2:r2:*:*:*:*:*:* Versions 20.2 r2 Vulnerable ·Juniper
- cpe:2.3:o:juniper:junos_os_evolved:20.3:r1:*:*:*:*:*:* Versions 20.3 r1 Vulnerable ·Juniper
- cpe:2.3:o:juniper:junos_os_evolved:20.3:r1-s1:*:*:*:*:*:* Versions 20.3 r1-s1 Vulnerable ·Juniper
Remediation
- Fix · CNA Junos OS Evolved (Juniper Networks) Fixed in 19.4R2-S3-EVO, 20.1R2-S3-EVO, 20.2R2-S1-EVO, 20.3R2-EVO
Timeline
- 2026-10-02 Threatist record created from CVE-2021-0226
- 2026-10-03 Alias added: GHSA-7jmp-9phw-35g8
References
Advisory 1
More Juniper Junos Os Evolved vulnerabilities
- TI-2026-17602 Junos OS Evolved: PTX Series: A vulnerability allows a unauthenticated, network-based attacker to execute code as root CVSS 4.0CRITICAL 9.3
- TI-2026-17601 Junos OS and Junos OS Evolved: Configuration of a specific SSH option results in mgd crash CVSS 4.0MEDIUM 6.7
- TI-2023-04136 Improper input validation in Juniper Junos OS CVSS 3.1HIGH 7.5
- TI-2026-74215 Stack-based buffer overflow in Junos OS rpd triggered by BGP peers CVSS 4.0CRITICAL 9.3
- TI-2026-74211 Authentication bypass in Juniper J-Web allows pre-auth CGI execution CVSS 4.0CRITICAL 9.3
- TI-2021-00146 Junos OS and Junos OS Evolved: Upon receipt of a specific BGP FlowSpec message network traffic may be disrupted. CVSS 3.1CRITICAL 10.0
Sources
- CVE-2021-0226 · CVE Program
- CVE-2021-0226 · NVD
- FIRST EPSS
- GHSA-7jmp-9phw-35g8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences