EUVD-2026-101346
GHSA-w7mj-v6m2-38qq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain adjacent network link access
-
DeliveryCraft malformed RSVP packet
-
ExploitSend to MPLS-TE RSVP listener
-
ExecutionTrigger NULL pointer dereference in rpd
-
ImpactCrash daemon and drop routing sessions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that MPLS-TE RSVP processing be enabled on the Junos OS or Junos OS Evolved device - on devices not configured for RSVP-TE signaling, the vulnerable code path is not reached. The attacker must also be positioned on an adjacent network (AV:A): same L2 segment, directly connected link, or adjacent routing/peering domain, not arbitrary internet reach. No authentication is required (PR:N) and no user interaction (UI:N), and the crafted RSVP packet alone triggers the fault. Limiting factors: the RSVP-TE/MPLS-TE feature dependency and the adjacency requirement meaningfully narrow the exposed population versus a remote, default-config flaw. |
| Impact | This is a moderate-severity, availability-only denial-of-service issue rather than a top-tier emergency. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) confirms an adjacent-network, low-complexity, unauthenticated attack with no confidentiality or integrity impact (VC:N/VI:N) and high availability impact to the vulnerable system (VA:H) plus a low subsequent-system availability effect (SA:L) reflecting disrupted routing sessions. The adjacent (AV:A) rather than network (AV:N) vector is the single biggest risk limiter: the attacker must be on the same L2/link segment or adjacent routing domain, not anywhere on the internet. No EPSS score, no CISA KEV listing, and no public POC were supplied, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Exploitation is further gated on MPLS-TE RSVP processing being enabled, so environments not running RSVP-TE are not exposed. Net: a genuine priority for carriers/enterprises running MPLS-TE at the edge of trusted segments, but not a drop-everything internet-facing crisis. Key missing data: EPSS and POC status are absent (not errors - simply not provided), and only a CVSS 4.0 vector was given, so any 3.1 figure is an independent derivation. |
| Exploit ScenarioDerived | An attacker with access to an adjacent network segment (e.g., a peering link or internal routing domain) sends a crafted RSVP packet to a Junos/Junos OS Evolved device that has MPLS-TE RSVP processing enabled. The malformed packet triggers a NULL pointer dereference in the routing protocol daemon (rpd), crashing it and tearing down routing protocol sessions, causing a network outage until rpd restarts. No public exploit code is identified at time of analysis, and no authentication is required (PR:N). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
A NULL pointer dereference in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated attacker on an adjacent network to terminate the daemon and disrupt routing protocol sessions by sending a crafted RSVP packet when MPLS-TE RSVP processing is enabled; the flaw carries a CVSS v4.0 base score of 7.1 (CVSS:3.1 equivalent AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and affects availability only, with no confidentiality or integrity impact. Exposure is bounded by two prerequisites - the device must actually be configured for RSVP-TE/MPLS-TE signaling, and the attacker must sit on the same L2 segment, directly connected link, or adjacent routing/peering domain rather than being reachable from the open internet. No public exploit code has been identified at time of analysis and there is no indication of confirmed active exploitation (not listed in CISA KEV); EPSS data was not provided in the available intelligence.
RemediationAI
Vendor-released patch: Juniper has published fixed releases for both code bases, and administrators should upgrade to Junos OS 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, or 26.2R1-S2, or to the corresponding Junos OS Evolved releases 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4X300-D40-EVO, or 26.2R1-S2-EVO, as applicable to the deployed train; full details are in Juniper advisory JSA112187 (https://supportportal.juniper.net/JSA112187). Where patching cannot be performed immediately, the most effective compensating control is to disable RSVP-TE/MPLS-TE signaling on interfaces that do not require it, since the vulnerable code path is only reached when RSVP processing is enabled - the trade-off is that this removes traffic-engineering and signaled-bandwidth functionality on the affected device. In addition, restrict the adjacent attack surface by filtering or rate-limiting RSVP traffic (IP protocol 46) on all external and peer-facing links so that only trusted, expected RSVP neighbors can deliver messages to rpd, and avoid untrusted or unnecessary L2/peering adjacencies in the MPLS-TE domain; this reduces but does not eliminate exposure for devices that must keep RSVP-TE enabled, and requires an accurate inventory of legitimate RSVP peers to avoid breaking established LSPs.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerable component is rpd, the Junos routing protocol daemon that implements routing and signaling protocols including RSVP. RSVP (Resource Reservation Protocol) is the signaling protocol used with MPLS Traffic Engineering (MPLS-TE / RSVP-TE) to establish label-switched paths with bandwidth reservations; when RSVP-TE processing is enabled, rpd parses inbound RSVP messages such as PATH and RESV objects and their nested objects. The root cause is class CWE-476, a NULL pointer dereference: a crafted RSVP packet causes a code path to dereference a pointer that has not been set, triggering a fault that terminates rpd rather than being handled gracefully. Because rpd owns routing protocol adjacencies and session state, its crash is not a purely local event - it tears down routing protocol sessions and can cause short-term routing churn or instability until the daemon restarts. The CPE strings identify two affected code bases, cpe:2.3:a:juniper_networks:junos_os and cpe:2.3:a:juniper_networks:junos_os_evolved, confirming both the classic FreeBSD-derived Junos OS trains and the Linux-based Junos OS Evolved trains are in scope. The CVSS v4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L) is consistent with the independent assessment: adjacent attack vector, low complexity, no privileges, no user interaction, high availability impact on the vulnerable system and only a low subsequent availability impact on others.
Know when Junos Os gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M
Adjacent unauthenticated RSVP packet with no interaction (AV:A/AC:L/PR:N/UI:N); only availability affected via rpd crash (C:N/I:N/A:H), scope unchanged.
Primary rating from Vendor (juniper).
CVSS VectorVendor: juniper
Lifecycle Timeline
4DescriptionCVE.org
A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent network attacker to cause a denial of service via a crafted RSVP packet when MPLS-TE RSVP processing is enabled. The condition can terminate rpd and disrupt routing protocol sessions.
Executive ViewAI
Juniper Junos OS and Junos OS Evolved are affected by a high-severity availability vulnerability in the routing protocol daemon (rpd); an adjacent unauthenticated attacker could terminate the daemon and disrupt routing sessions, potentially causing network outages for organizations with MPLS-TE RSVP enabled. The exposure requires specific configuration and adjacent network access, but the impact on routing availability could affect business services, customers, and SLAs. No public exploit identified at time of analysis, and a vendor patch is available.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
OS command injection in the phcd phone-home daemon of Juniper Networks Junos OS and Junos OS Evolved lets an adjacent, u
Unauthenticated remote code execution with root privileges affects Juniper Networks Junos OS devices that expose the J-W
Heap-based buffer overflow in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allow
A stack-based buffer overflow in the srxpfe packet forwarding process of Juniper Networks Junos OS on SRX Series devices
Unauthenticated remote code execution with elevated privileges is possible in Juniper Junos OS and Junos OS Evolved thro
Remote root code execution in the routing protocol daemon (rpd) of Juniper Junos OS is reachable through protocol-valid
Remote code execution (on Junos OS) and rpd denial of service (on Junos OS and Junos OS Evolved) result from a stack-bas
Remote code execution with root privileges on Juniper Networks Junos OS and Junos OS Evolved is possible when the routin
Remote code execution and denial of service in Juniper Networks Junos OS and Junos OS Evolved arise from a stack-based b
Unauthenticated remote attackers can gain root-level configuration access and fully compromise Juniper Junos OS and Juno
Integer underflow in the Junos OS kernel can crash a device when the Extended Echo feature (RFC 8335 ICMP probing) is co
Heap-based buffer overflow in Juniper Networks Junos OS on SRX Series devices that have Secure Vector Routing (SVR) enab
Exploit-DB