Juniper Junos OS: NULL pointer dereference in routing policy ECMP matcher

Summary

A NULL pointer dereference in the nexthop-ECMP matcher of Junos OS and Junos OS Evolved can crash the routing daemon (rpd). A configured eBGP peer can trigger it with a specific BGP packet, but only if a nexthop-ecmp qualifier is attached to a BGP import policy. The impact is a denial of service on the router, with no confidentiality or integrity impact listed. The CNA rates it CVSS v4.0 8.7 (High), and NVD analysis was still pending at the time of research.

Affected

• Junos OS: 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; 26.2 before 26.2R1-S2 (default configuration unaffected)
• Junos OS Evolved: 23.4 before 23.4R2-S8.11-EVO; 24.2 before 24.2R2-S5.6-EVO; 24.4 before 24.4R2-S5-EVO; 25.2 before 25.2R2-S2-EVO; 25.4 before 25.4R1-S3-EVO; 26.2 before 26.2R1-S2-EVO
• Also listed: 23.4X100 (fix status unknown); 25.2X100 before 25.2X100-D35-EVO; 25.4X300 before 25.4X300-D40-EVO

Fixed in

• Junos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1 and later
• Junos OS Evolved: 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO and later
• Fix for 23.4X100: Unknown. Confirm in JSA112187.

Workaround

• No vendor workaround: none known.
• Possible exposure reduction, to be confirmed with Juniper before changes on production routers: remove unneeded nexthop-ecmp qualifiers from BGP import policies and restrict or authenticate eBGP peers.

Exploitation

• Juniper SIRT is not aware of any malicious exploitation.
• Not listed in the CISA KEV catalog at the time of research.
• CISA SSVC: exploitation none, automatable yes, technical impact partial.

Our recommendation

• Inventory Junos OS and Junos OS Evolved devices that run BGP and compare their versions with JSA112187.
• Check whether nexthop-ecmp is used in any BGP import policy and remove it where it is not needed.
• Plan upgrades to the fixed releases, starting with routers that peer with external parties. Confirm the fix status for 23.4X100 with Juniper.
• Restrict eBGP peers to known neighbours and consider session protection such as MD5 or TTL security.
• Monitor for rpd crashes and restarts.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Juniper Security Advisory JSA112187 supportportal.juniper.net
• CVE record mirror (threatint) cve.threatint.com
• OpenCVE entry app.opencve.io
• Vulnrichment (Vulners) vulners.com
• Strix CVE summary www.strix.ai
• Secondary bulletin commentary (SecurityOnline) securityonline.info

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 02:54.