Juniper Junos OS: NULL pointer dereference in rpd allows denial of service

Summary

A NULL pointer dereference in the routing protocol daemon (rpd) of Junos OS and Junos OS Evolved can be triggered by a specific VPN-flowspec BGP update. An unauthenticated remote BGP neighbor can crash rpd and cause a denial of service. The issue only applies if the update is readvertised and BMP post-policy RIB-out monitoring is configured, and the default configuration is not affected.

Affected

• Junos OS: 0 to before 23.2R2-S7.7; 23.4 to before 23.4R2-S8.13; 24.2 to before 24.2R2-S5.5; 24.4 to before 24.4R2-S5; 25.2 to before 25.2R2-S2; 25.4 to before 25.4R1-S3; 26.2 to before 26.2R1-S2
• Junos OS Evolved: 0 to before 23.2R2-S7.7-EVO; 23.4 to before 23.4R2-S8.11-EVO; 24.2 to before 24.2R2-S5.6-EVO; 24.4 to before 24.4R2-S5-EVO; 25.2 to before 25.2R2-S2-EVO; 25.4 to before 25.4R1-S3-EVO; 26.2 to before 26.2R1-S2-EVO; plus 23.4X100, 25.2X100 to before 25.2X100-D35-EVO and 25.4X300 to before 25.4X300-D40-EVO
• Required configuration: protocols bgp bmp route-monitoring rib-out post-policy and protocols bgp family inet-vpn flow

Fixed in

• Junos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1 and all subsequent releases
• Junos OS Evolved: 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO and all subsequent releases
• Unknown for Junos OS Evolved 23.4X100 (no fixed release listed)
• Juniper has rebuilt previously published respins for 23.2, 23.4 and 24.2 releases
• Verify all versions on the vendor advisory before acting

Workaround

Unknown. The CVE record states that there are no known workarounds; upgrading is the only documented remedy.

Exploitation

• Juniper SIRT is not aware of any malicious exploitation.
• CISA SSVC: exploitation none, automatable yes, technical impact partial.
• No public exploit is known (VulDB). The CVE is not listed in CISA KEV.

Our recommendation

• Check whether any Junos OS or Junos OS Evolved device uses BGP with VPN-flowspec together with BMP RIB-out post-policy monitoring.
• Plan an upgrade to a fixed release as listed in vendor advisory JSA112187. Cover the whole advisory in the same patch cycle, because other rpd issues are covered too.
• Limit BGP peering to trusted, authenticated neighbors and monitor for rpd crashes.
• Priority is low for typical SME networks without BGP peering, and higher for ISP, data-centre or MPLS/VPN operators.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Juniper Security Advisory JSA112187 supportportal.juniper.net
• CVE record on OpenCVE app.opencve.io
• VulnRichment entry on Vulners vulners.com
• VulDB entry vuldb.com
• FastNetMon summary of Juniper advisory vulnerabilities fastnetmon.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 02:57.