Juniper Junos OS CVE-2026-101975

Exploitation requires that the target router be configured with OSPF Source Packet Routing (segment routing / SPRING) best-route Prefix-SID installation - this is the explicit enabling condition; routers without this feature configured are not affected. The attacker must also hold an adjacent position as an OSPF peer (AV:A), meaning they must be within the OSPF routing domain and able to form or source traffic on an adjacency rather than attacking across the internet. Limiting factors: non-default segment-routing configuration, required OSPF adjacency/topology access, and availability-only impact (no data compromise). Impact is confined to denial of service via rpd crash.

This is a genuine but conditional priority, not an inflated high-CVSS issue. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) scores 7.1 driven entirely by availability impact (VA:H, SA:L) with no confidentiality or integrity loss, consistent with the CWE-617 Reachable Assertion / rpd crash denial-of-service class. The adjacent attack vector (AV:A) is the single most important risk-limiting signal: the attacker must be an established OSPF peer in the same routing domain, so this is not internet-wide remotely exploitable - it requires a position inside the routed topology. No EPSS score, SSVC decision, KEV listing, or POC is present in the provided data; per the data, there is no public exploit identified at time of analysis and no evidence of active exploitation. Exploitation is further gated by a non-default feature: OSPF Source Packet Routing (segment routing) best-route Prefix-SID installation must be configured. Note the PR:N / adjacency tension: the vector marks it unauthenticated, but an OSPF adjacency normally presumes the attacker is an accepted neighbor (and may be authenticated at the OSPF layer) - verify neighbor authentication posture with Juniper before treating this as fully unauthenticated. Net: patch promptly on devices running segment routing with Prefix-SID installation, but raw exposure is bounded by adjacency and configuration.

An attacker who has established (or compromised a device holding) an OSPF adjacency with a vulnerable Junos/Junos Evolved router sends crafted OSPF traffic that the rpd daemon mis-handles while SPRING best-route Prefix-SID installation is active, tripping an assertion. The rpd daemon crashes, dropping routing adjacencies and causing a denial of service; sustained sending can keep rpd in a crash loop. No public exploit code is identified at time of analysis, and the adjacent attack vector means the attacker must already be inside the OSPF domain.