Junos OS: NULL pointer dereference in rpd allows BGP denial of service

Summary

A NULL pointer dereference in the routing protocol daemon (rpd) of Junos OS and Junos OS Evolved allows a configured BGP neighbor to crash the daemon with a crafted route update, causing a denial of service. The flaw only triggers when routing-policy resolution-map and policy event tracing are enabled. An attacker needs an established BGP session with the device, so internet exposure alone is not sufficient.

Affected

• Junos OS: releases below 23.2R2-S7.7, 23.4 before 23.4R2-S8.13, 24.2 before 24.2R2-S5.5, 24.4 before 24.4R2-S5, 25.2 before 25.2R2-S2, 25.4 before 25.4R1-S3, 26.2 before 26.2R1-S2 (default configuration unaffected)
• Junos OS Evolved: releases below 23.2R2-S7.7-EVO, 23.4 before 23.4R2-S8.11-EVO, 24.2 before 24.2R2-S5.6-EVO, 24.4 before 24.4R2-S5-EVO, 25.2 before 25.2R2-S2-EVO, 25.4 before 25.4R1-S3-EVO, 26.2 before 26.2R1-S2-EVO, plus special builds 23.4X100, 25.2X100 before 25.2X100-D35-EVO and 25.4X300 before 25.4X300-D40-EVO (default configuration unaffected)
• Required configuration: system configuration-database ephemeral instance, resolution-map and policy event tracing

Fixed in

• Junos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1 and later
• Junos OS Evolved: 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO and later
• Verify the exact release per platform in Juniper advisory JSA112187

Workaround

• No known workarounds in the CVE record.
• A third-party analysis suggests disabling policy event tracing until the upgrade. This is unverified and must be confirmed with Juniper before use.

Exploitation

• Juniper SIRT is not aware of any malicious exploitation.
• CISA SSVC: exploitation none, automatable yes, technical impact partial.
• No public proof of concept or known-exploited listing found.

Our recommendation

• Inventory all Junos OS and Junos OS Evolved devices and their versions, and check whether BGP is configured.
• Check whether the resolution-map and policy event tracing configuration is present.
• Read JSA112187 and apply the fixed release for each platform, prioritising devices with external BGP peers.
• Until patched, review BGP peer lists and session authentication, and monitor for rpd restarts or crash files.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Juniper Security Advisory JSA112187 supportportal.juniper.net
• CVE record mirror (OpenCVE) app.opencve.io
• Canadian Cyber Centre advisory AV26-1043 www.cyber.gc.ca
• HKCERT security bulletin on Juniper Junos OS www.hkcert.org
• CVE mirror (threatint) cve.threatint.com
• Strix CVE mirror www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:00.