Juniper Junos OS: NULL pointer dereference in rpd via BGP FlowSpec update

Summary

A NULL pointer dereference in the routing protocol daemon (rpd) of Junos OS and Junos OS Evolved lets a remote, unauthenticated BGP peer crash rpd with a specific BGP FlowSpec update. The crash occurs only when BGP FlowSpec import policy is used. The impact is a denial of service that disrupts BGP routing on the affected device; no confidentiality or integrity impact is stated.

Affected

• Junos OS 25.2 to before 25.2R2-S2
• Junos OS 25.4 to before 25.4R1-S3
• Junos OS 26.2 to before 26.2R1-S2
• Junos OS Evolved 25.2 to before 25.2R2-S2-EVO
• Junos OS Evolved 25.4 to before 25.4R1-S3-EVO
• Junos OS Evolved 26.2 to before 26.2R1-S2-EVO
• Junos OS Evolved 23.4X100 (listed by the CNA; not confirmed by all sources)
• Junos OS Evolved 25.2X100 to before 25.2X100-D35-EVO
• Junos OS Evolved 25.4X300 to before 25.4X300-D40-EVO

Default configuration: unaffected. Affected only with BGP FlowSpec import policy.

Fixed in

Per the CNA record (verify against JSA112187):

• Junos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1 and later
• Junos OS Evolved: 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO and later

For 23.2, 23.4 and 24.2 (and the -EVO equivalents), Juniper has issued respins; previously published builds of these releases have been rebuilt.

Workaround

Unknown. The CNA record states there are no known workarounds.

• Limit which BGP peers can send FlowSpec routes and review FlowSpec import policy (suggestion, not from the vendor).

Exploitation

• Juniper SIRT is not aware of any malicious exploitation.
• Not listed in CISA KEV.
• CISA SSVC: exploitation none, automatable yes, technical impact partial.
• No public proof-of-concept found in the research.

Our recommendation

• Check whether any Junos OS or Junos OS Evolved device runs BGP and whether FlowSpec import policy is configured.
• Identify the fixed release for your platform and train in JSA112187 and install it in the next maintenance window; do this sooner if BGP peers are outside your control.
• Restrict BGP sessions and FlowSpec routes to trusted peers in the meantime.
• Monitor rpd for crashes and BGP session resets.
• Low exposure for most SMEs without their own BGP peering; higher for ISPs, hosting providers and multihomed sites.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Juniper Security Advisory JSA112187 supportportal.juniper.net
• OpenCVE: CVE-2026-101948 app.opencve.io
• Strix: CVE-2026-101948 www.strix.ai
• Offseq Radar: CVE-2026-101948 radar.offseq.com
• Positive Technologies: PT-2026-113802 vulners.com
• FastNetMon: Juniper Junos OS vulnerabilities (BGP FlowSpec and IKE) fastnetmon.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 03:56.