Junos OS CVE-2026-101939

Two concrete prerequisites must both hold: (1) the device must be configured with an import policy containing then source-based-forwarding next-hop next-table <X> where <X> references a routing table that does not exist - a specific non-default routing configuration; and (2) the attacker must be a configured BGP peer of the device, able to send BGP UPDATE messages over an established session. Limiting factors: the vulnerable source-based-forwarding policy is not present in default configurations, and the attacker needs an operator-sanctioned BGP peering relationship rather than arbitrary unsolicited network access - both substantially narrow real-world exploitability despite the network attack vector.

The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores 8.7 (High) and signals a network-reachable, low-complexity availability attack with high impact to the vulnerable system (VA:H) plus a low subsequent-system availability impact (SA:L), consistent with a routing-daemon crash rippling into network reachability. The supplemental/threat metrics in the input are largely undefined (E:X), and no EPSS probability, CISA KEV listing, or public POC was provided - so despite the high base score, there is no evidence of active or imminent exploitation. Critically, PR:N (unauthenticated) is in tension with the description's requirement that the attacker be a 'configured peer': the device operator must have deliberately established a BGP session with the attacker, which is a meaningful trust/relationship prerequisite not captured by PR:N. Exploitation is further gated by a specific NON-DEFAULT import policy (then source-based-forwarding next-hop next-table <X> referencing a non-existent routing table), so the real-world attack surface is far narrower than the raw 8.7 implies. Net: a genuine, vendor-confirmed DoS worth patching for operators running the affected configuration and peering with untrusted or semi-trusted neighbors, but not a broad, spray-and-pray threat - treat as configuration-dependent and prioritize by whether the vulnerable policy is deployed.

An attacker who controls a BGP neighbor already configured as a peer on a Junos OS / Junos OS Evolved device sends a crafted BGP UPDATE. If the device's import policy uses then source-based-forwarding next-hop next-table <X> pointing at a routing table that does not exist, the routing protocol daemon (RPD) dereferences a NULL pointer and crashes, causing a denial of service. No public exploit code was identified at the time of analysis.