EUVD-2026-101482
GHSA-mhg9-x642-cgj6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain adjacent LDP peer position
-
DeliveryEstablish operational LDP session
-
ExploitSend crafted LDP message
-
ExecutionTrigger NULL dereference in rpd
-
ImpactCrash routing daemon (DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires MPLS with LDP configured and running on the target, and an already-operational LDP session with the victim - the attacker must be an established/adjacent LDP peer, so this is not exploitable against default (non-MPLS/non-LDP) configurations. Exploitation is unauthenticated (PR:N) but constrained to the adjacent network position (AV:A), meaning the attacker must sit on the same routing segment or be an accepted LDP neighbor rather than attack over the open Internet. Limiting factors: LDP feature must be enabled, a live LDP session must exist, and attacker must have adjacency - these materially reduce the realistic exposed population despite the unauthenticated vector. |
| Impact | This is a moderate-severity, single-impact (availability-only) denial-of-service flaw. The vendor CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) and the description agree internally: exploitation is adjacent (not routable Internet-wide), unauthenticated, and low-complexity, with VA:H plus SA:L capturing the crash of the routing daemon and resulting loss of routed traffic. There is no CVSS 3.1 vector in the input, no EPSS probability, no KEV listing, and no POC - so every exploitation-likelihood signal beyond CVSS is simply absent rather than conflicting. The practical gating factor is the requirement for an 'operational LDP session': the attacker must already be an established or adjacent LDP peer, which substantially narrows the attacker population versus a raw AV:A reading and makes untargeted mass exploitation unlikely. Net: a real but bounded priority - patch on MPLS/LDP-enabled routers, especially in carrier/ISP cores, but it is not a drop-everything Internet-exposed RCE. No availability of EPSS/KEV/POC data means exploitation likelihood cannot be quantified from the provided sources. |
| Exploit ScenarioDerived | An attacker positioned as an adjacent LDP peer (or on the same L2 segment able to participate in LDP) sends a malformed LDP message over an already-operational LDP session to a Junos OS or Junos OS Evolved device. The message triggers a NULL pointer dereference in the routing protocol daemon (rpd), crashing it and disrupting MPLS label distribution and routing on the target. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Oct 14, 2026
Denial of service in Juniper Networks Junos OS and Junos OS Evolved occurs when an unauthenticated adjacent attacker who is an established LDP peer sends crafted LDP messages, triggering a NULL pointer dereference in the routing protocol daemon (rpd) that can crash the daemon. The flaw is availability-only (CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and requires MPLS with LDP configured and an operational LDP session; default configurations without MPLS/LDP are not exploitable. No public exploit was identified at time of analysis and the issue is not listed in CISA KEV.
Earlier versions of this analysis (2)
Crafted LDP messages sent over an operational LDP session to Juniper Networks Junos OS or Junos OS Evolved can trigger a NULL pointer dereference in the routing protocol daemon (rpd), leading to a denial of service. The attacker must be on an adjacent network and no authentication is required, but exploitation is limited to deployments where MPLS with LDP is configured and an LDP session is established with the attacker's adjacent device. No public exploit code or active exploitation has been identified at time of analysis, and the real-world risk is tightly bounded by these preconditions.
Denial of service in Juniper Junos OS and Junos OS Evolved occurs when the routing protocol daemon (rpd) dereferences a NULL pointer while processing crafted LDP messages received over an already-established LDP session, crashing the daemon and disrupting routing. The flaw is remotely triggerable by an adjacent (AV:A), unauthenticated (PR:N) attacker but only on devices where LDP/MPLS is configured and an operational LDP peering relationship exists; non-LDP deployments are effectively unaffected, and impact is limited to availability (CVSS 6.5, C:N/I:N/A:H). No public exploit code or confirmed active exploitation was identified at time of analysis, so risk should be prioritized by actual LDP/MPLS exposure rather than the base score alone.
RemediationAI
Apply the patched Junos OS or Junos OS Evolved release specified in Juniper advisory JSA112187 (https://supportportal.juniper.net/JSA112187); no fixed version is provided in the available data, so consult the advisory for exact patched releases. If patching is not immediately possible, disable LDP or MPLS if those features are not required-this removes the attack surface but will break MPLS-based services that depend on LDP. If LDP must remain enabled, restrict LDP peering to trusted adjacent routers using firewall filters or ACLs that permit LDP (port 646) only from authorized neighbors, and enable LDP MD5 authentication where supported; note that authentication does not stop a compromised or malicious established LDP peer from sending crafted messages and may not fully mitigate the issue. Additionally, monitor rpd for crashes and consider routing protocol graceful restart or nonstop routing to reduce downtime, though these do not prevent the flaw. Refer to the vendor advisory for the latest mitigation guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a NULL pointer dereference (CWE-476) in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. rpd handles routing protocols including Label Distribution Protocol (LDP), which is used to distribute MPLS labels between adjacent routers. An attacker who already has an operational LDP session with the target can send a specially crafted LDP message that causes rpd to dereference a NULL pointer, leading to a crash and denial of service. The CPE data lists all versions of junos_os and junos_os_evolved with wildcard version fields, indicating the flaw affects the operating systems generally rather than a specific release range in the provided data. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L) and the independent CVSS 3.1 assessment (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirm an adjacent, unauthenticated, availability-only impact; no confidentiality or integrity impact is assessed. Exploitation is limited by the need for MPLS/LDP to be enabled and a live LDP session to exist.
Know when Junos Os gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L
Adjacent unauthenticated LDP peer (AV:A, PR:N) sends low-complexity crafted message (AC:L); impact is rpd crash with availability loss only (A:H, C:N/I:N), no scope change.
Primary rating from Vendor (juniper).
CVSS VectorVendor: juniper
Lifecycle Timeline
4DescriptionCVE.org
A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via LDP messages received over an operational LDP session.
Executive ViewAI
A high-severity availability flaw in Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated attacker on an adjacent network segment who is already an established LDP peer to crash the routing protocol daemon (rpd), disrupting routing and MPLS-dependent connectivity on affected devices. Only environments running MPLS with LDP configured and an active LDP session are exposed, so impact is concentrated in service-provider, WAN, and large enterprise core networks where outages translate directly into customer-facing or revenue-impacting downtime. No vendor patch is currently available, and no public exploit has been identified at time of analysis, giving leadership a limited but real window to reduce exposure through network-level controls.
No vendor-released patch identified at time of analysis. Interim mitigations: disable MPLS/LDP where not operationally required; restrict LDP (TCP/UDP 646) to an explicit allowlist of trusted adjacent peers via interface ACLs and control-plane policing; block LDP traffic from untrusted adjacent segments; enable LDP authentication where supported; monitor and alert on routing protocol daemon (rpd) crashes or restarts; and maintain a rollback/backup routing path for MPLS-dependent services.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
OS command injection in the phcd phone-home daemon of Juniper Networks Junos OS and Junos OS Evolved lets an adjacent, u
Unauthenticated remote code execution with root privileges affects Juniper Networks Junos OS devices that expose the J-W
Heap-based buffer overflow in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allow
A stack-based buffer overflow in the srxpfe packet forwarding process of Juniper Networks Junos OS on SRX Series devices
Unauthenticated remote code execution with elevated privileges is possible in Juniper Junos OS and Junos OS Evolved thro
Remote root code execution in the routing protocol daemon (rpd) of Juniper Junos OS is reachable through protocol-valid
Remote code execution (on Junos OS) and rpd denial of service (on Junos OS and Junos OS Evolved) result from a stack-bas
Remote code execution with root privileges on Juniper Networks Junos OS and Junos OS Evolved is possible when the routin
Remote code execution and denial of service in Juniper Networks Junos OS and Junos OS Evolved arise from a stack-based b
Unauthenticated remote attackers can gain root-level configuration access and fully compromise Juniper Junos OS and Juno
Integer underflow in the Junos OS kernel can crash a device when the Extended Echo feature (RFC 8335 ICMP probing) is co
Heap-based buffer overflow in Juniper Networks Junos OS on SRX Series devices that have Secure Vector Routing (SVR) enab
Exploit-DB