IT SBIT Services
Schneeberger
DEEN
CVE tracker

Junos OS: Denial of service via NULL pointer dereference in routing daemon

CVE-2026-101939High 8.7

← All vulnerabilities

Summary

A NULL pointer dereference in the routing protocol daemon (RPD) of Junos OS and Junos OS Evolved can be triggered by a configured BGP peer sending a crafted UPDATE message. The attack requires an import policy with a source-based-forwarding next-hop referencing a routing table that does not exist. Successful exploitation crashes the routing daemon and interrupts routing services, but does not give the attacker code execution or data access according to the CNA's vector.

Affected

  • Junos OS: 0 to before 23.2R2-S7.7; 23.4 to before 23.4R2-S8.13; 24.2 to before 24.2R2-S5.5; 24.4 to before 24.4R2-S5; 25.2 to before 25.2R2-S2; 25.4 to before 25.4R1-S3; 26.2 to before 26.2R1-S2
  • Junos OS Evolved: multiple release trains including 23.4X100 and 25.2X100 to before 25.2X100-D35-EVO and 25.4X300 to before 25.4X300-D40-EVO (see JSA112187 for the full list)
  • Only configurations with the vulnerable import policy are affected.

Fixed in

  • Junos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1 and later
  • Junos OS Evolved: 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO and later
  • Verify exact builds per platform in JSA112187.

Workaround

Unknown. The CNA states that there are no known workarounds. Upgrading is the fix.

Exploitation

  • Juniper SIRT is not aware of malicious exploitation.
  • Not listed in CISA KEV; EPSS below 1%.
  • CISA SSVC: exploitation none, automatable yes, technical impact partial.
  • No public proof of concept found in our research; this does not exclude that one exists.

Our recommendation

  • Check whether any Juniper devices run BGP with external or untrusted peers.
  • Review import policies for source-based-forwarding next-table references and confirm the referenced routing tables exist.
  • Patch affected Junos OS or Junos OS Evolved devices to the fixed releases in JSA112187 in the next maintenance window.
  • Watch for rpd restarts or crash files as indicators of attempted exploitation.
  • Note the CVSS discrepancy: CNA 8.7 (CVSS 4.0), NVD 7.5 (CVSS 3.1); NVD status is Awaiting Analysis.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 03:57.

Original description (NVD)

A NULL Pointer Dereference vulnerability in the routing protocol daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows a configured peer sending a BGP UPDATE to cause a denial of service when an import policy with `then source-based-forwarding next-hop next-table <X>` is configured to reference a routing table that does not exist.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed