Juniper Junos OS: Denial of service via NULL pointer dereference in rpd

Summary

A NULL pointer dereference in the rpd routing daemon of Junos OS and Junos OS Evolved allows an unauthenticated, configured BGP peer to crash the daemon with a crafted BGP UPDATE message. The issue only applies when both ISO-VPN and egress-protection are enabled. A successful attack causes a denial of service on the router and disrupts routing. Juniper SIRT is not aware of any malicious exploitation.

Affected

• Junos OS: 0 to below 23.2R2-S7.7; 23.4 to below 23.4R2-S8.13; 24.2 to below 24.2R2-S5.5; 24.4 to below 24.4R2-S5; 25.2 to below 25.2R2-S2; 25.4 to below 25.4R1-S3; 26.2 to below 26.2R1-S2
• Junos OS Evolved: 0 to below 23.2R2-S7.7-EVO; 23.4 to below 23.4R2-S8.11-EVO; 24.2 to below 24.2R2-S5.6-EVO; 24.4 to below 24.4R2-S5-EVO; 25.2 to below 25.2R2-S2-EVO; 25.4 to below 25.4R1-S3-EVO; 26.2 to below 26.2R1-S2-EVO; 23.4X100; 25.2X100 to below 25.2X100-D35-EVO; 25.4X300 to below 25.4X300-D40-EVO
• Only when ISO-VPN and egress-protection are configured. The default configuration is unaffected.

Fixed in

• Junos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1, and all subsequent releases
• Junos OS Evolved: 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO, and all subsequent releases
• Junos OS Evolved 23.4X100: Unknown.
• Releases 23.2, 23.4 and 24.2 (and their EVO equivalents) have respins; previously published builds were rebuilt.

Workaround

• No known workarounds according to Juniper.

Exploitation

• Juniper SIRT is not aware of any malicious exploitation.
• CISA SSVC: exploitation none, automatable yes, technical impact partial.
• No public proof of concept found in research. CISA KEV and GitHub were not checked directly.

Our recommendation

• Check whether any Junos or Junos Evolved router runs ISO-VPN together with egress protection.
• If so, review whether the BGP peers are outside your control and limit which peers can reach the router.
• Plan the upgrade to the fixed release for your train, as listed in Juniper bulletin JSA112187, and verify the versions there first.
• Most SMEs are probably not affected; confirm with a configuration check.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Juniper Security Advisory JSA112187 supportportal.juniper.net
• OpenCVE: CVE-2026-101940 app.opencve.io
• Strix: CVE-2026-101940 www.strix.ai
• Safeguard: CVE-2026-101940 analysis safeguard.sh
• Juniper documentation: Edge node failure protection with BGP-signalled PWs www.juniper.net

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 03:58.