Juniper Junos OS CVE-2026-101971

Exploitation requires that OSPFv3 be configured and enabled on a broadcast interface of the target Junos OS / Junos OS Evolved device, and that the attacker have Layer-2 adjacency to that broadcast segment (AV:A) to inject OSPFv3 protocol messages. No authentication or user interaction is needed (PR:N/UI:N). The key limiting factors are: (1) the device must actually run OSPFv3 on a broadcast-mode interface - routers without OSPFv3 or using point-to-point interface types are not exposed; and (2) the attacker must already be on the same broadcast domain, so the flaw is not exploitable across routed/internet boundaries, confining risk to insiders or adjacent compromised nodes.

This is a moderate-severity denial-of-service flaw (vendor CVSS 4.0 7.1) in the rpd routing daemon of Juniper Junos OS and Junos OS Evolved. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L) indicates an adjacent-network, low-complexity, unauthenticated attack with no user interaction, whose primary impact is loss of availability (VA:H) plus a low subsequent-system availability effect (SA:L) - consistent with an rpd crash/reboot and the described heap memory corruption. Crucially, this is NOT a remote (AV:N) internet-facing issue: AV:A means the attacker must sit on the same Layer-2 broadcast segment as an OSPFv3-enabled interface, which substantially narrows the real-world attack surface to insiders or already-compromised adjacent hosts. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The combination of unauthenticated + low-complexity is concerning, but the adjacency requirement and availability-only impact place this as a real-but-bounded priority for network operators running OSPFv3 on broadcast interfaces, rather than a drop-everything emergency. Note the 'Buffer Overflow' tag and the 'heap memory corruption' language in the description could imply a memory-safety/integrity angle, yet the vendor vector sets VI:N (no integrity impact) - if code execution were a concern it would be rated higher, so treat this as a DoS-class issue unless the vendor advisory states otherwise.

An attacker positioned on the same broadcast LAN segment as a Junos OSPFv3-enabled interface (e.g., a compromised host or rogue device on a shared transit/access segment) sends specially crafted OSPFv3 messages to the router. The unthrottled resource allocation triggers heap memory corruption in rpd, crashing the routing daemon and causing a denial of service that disrupts routing on the device. No authentication or user interaction is required, but no public exploit code is identified at time of analysis.