Junos OS: NULL pointer dereference in rpd causes persistent routing daemon DoS
Summary
A NULL pointer dereference in the routing protocol daemon (rpd) of Junos OS and Junos OS Evolved can be triggered by a specific BGP packet. A configured eBGP peer can send this packet and cause a persistent denial of service of rpd, which interrupts routing services. The flaw only applies when ephemeral configuration is used.
Affected
- Junos OS: 0 to below 23.2R2-S7.7; 23.4 to below 23.4R2-S8.13; 24.2 to below 24.2R2-S5.5; 24.4 to below 24.4R2-S5; 25.2 to below 25.2R2-S2; 25.4 to below 25.4R1-S3; 26.2 to below 26.2R1-S2
- Junos OS Evolved: 0 to below 23.2R2-S7.7-EVO; 23.4 to below 23.4R2-S8.11-EVO; 24.2 to below 24.2R2-S5.6-EVO; 24.4 to below 24.4R2-S5-EVO; 25.2 to below 25.2R2-S2-EVO; 25.4 to below 25.4R1-S3-EVO; 26.2 to below 26.2R1-S2-EVO; 23.4X100; 25.2X100 to below 25.2X100-D35-EVO; 25.4X300 to below 25.4X300-D40-EVO
- The default configuration is not affected.
Fixed in
- Junos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1 and all subsequent releases
- Junos OS Evolved: 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO and all subsequent releases
Workaround
- No known workarounds according to Juniper.
Exploitation
- Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
- CISA SSVC assessment: exploitation none, automatable yes, technical impact partial.
Our recommendation
- Check whether devices run Junos OS or Junos OS Evolved and whether eBGP sessions are configured.
- Check whether ephemeral configuration is used. If it is not, the exposure is low.
- Upgrade to a fixed release listed above and verify the version table on JSA112187.
- Monitor for unexpected rpd restarts and routing outages.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Juniper Security Advisory JSA112187 supportportal.juniper.net
- OpenCVE: CVE-2026-101977 app.opencve.io
- Strix: CVE-2026-101977 www.strix.ai
- Vulners: BDU:2026-17892 vulners.com
- SecurityOnline: Juniper patches Junos OS vulnerabilities securityonline.info
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 03:50.
Original description (NVD)
A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP peer to cause a persistent routing-daemon denial of service via a specific BGP packet when ephemeral configuration is used.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.