Juniper Junos OS CVE-2026-102029

The affected device must be running Junos OS or Junos OS Evolved with MSDP or PIM configured AND a routing policy that uses AS-path expansion - this is a non-default multicast configuration, not a stock setup. The attacker must either already be a configured MSDP peer of the target (an admin-established trust relationship) or be an adjacent PIM sender able to send PIM messages to the device. Although the CVSS vector is PR:N (unauthenticated), these positional and configuration prerequisites are the real limiting factors: devices without multicast/MSDP/PIM, or without AS-path-expansion policies, are not exploitable, and the attacker cannot reach the condition from an arbitrary internet position without the requisite peering/adjacency. Impact is limited to denial of service (routing daemon crash); there is no data exposure or code execution.

This is an availability-only denial-of-service flaw (CWE-476 NULL pointer dereference in rpd) rated CVSS 4.0 base 8.7 by Juniper, with the vector confirming network reach, low complexity, and no privileges or user interaction (AV:N/AC:L/AT:N/PR:N/UI:N), and impact limited entirely to availability (VC:N/VI:N/VA:H, with a minor subsequent-system availability effect SA:L reflecting that an rpd crash degrades routing for dependent systems). The headline score is driven purely by the VA:H availability hit - there is no confidentiality or integrity exposure and no code execution. Several key exploitation signals are MISSING from the input: no EPSS probability was provided, there is no CISA KEV listing, and no public exploit is referenced, so there is no public exploit identified at time of analysis. Critically, the raw CVSS PR:N overstates real-world accessibility: the description requires the attacker to be an already-configured MSDP peer (a deliberate, admin-established trust relationship) or an adjacent PIM sender, AND the target must be running a non-default MSDP or PIM policy that uses AS-path expansion. These conditions sharply narrow the realistic attack surface to multicast-enabled deployments with a specific policy configuration and a semi-trusted network position, so this is a high-CVSS issue whose true priority is moderate-to-high only for operators running affected multicast configurations, and low for the majority of Junos deployments that do not. Verify your MSDP/PIM configuration against the Juniper advisory to determine applicability.

An attacker who has been configured as an MSDP peer on an affected Junos OS or Junos OS Evolved device (or who is an adjacent PIM sender on a connected segment) sends a crafted MSDP or PIM message that is processed by a policy using AS-path expansion. The malformed input causes rpd to dereference a NULL pointer and crash, disrupting routing on the device until the daemon recovers. No public exploit code is identified in the provided data, and exploitation requires the specific multicast policy configuration to be present.