Junos OS CVE-2026-102039

The device must be configured for EVPL (Ethernet Virtual Private Line) service with an LMP (Link Management Protocol) control channel enabled, and RSVP signaling must be processed over that channel - this is not a default configuration. The attacker must be network-adjacent to the LMP control channel (AV:A), limiting exploitation to attackers with L2/control-plane reachability rather than arbitrary remote hosts. No authentication is required (PR:N) and no user interaction is needed (UI:N), but the dependency on the EVPL/LMP feature being active is the primary limiting factor; devices not using EVPL LMP are not exposed.

This is a moderate-severity, targeted availability issue rather than a top-tier emergency. The vendor-supplied CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L, score 7.1) is internally consistent with the description: an adjacent (not remote-internet), unauthenticated attacker triggers a NULL pointer dereference (CWE-476) that crashes the rpd routing daemon, yielding high availability impact with no confidentiality or integrity loss. Key risk-tempering signals: the attack vector is Adjacent (AV:A), meaning the attacker must be on the same L2/LMP control-channel segment, not arbitrary internet hosts, and exploitation depends on a specific feature (EVPL LMP control channel) being configured. No EPSS score, KEV listing, or POC is present in the provided data, so there is no evidence of active exploitation or public weaponization - this is not a confirmed in-the-wild threat. The CVSS vector agrees with the description (adjacent, unauthenticated, DoS-only), so no signal conflict exists; the main gap is the absence of exploitation-probability data (no EPSS) and the lack of a confirmed fixed-version list in the supplied references.

An attacker positioned on an adjacent network segment that participates in an EVPL Link Management Protocol (LMP) control channel sends a crafted, malformed RSVP Path message to a vulnerable Junos OS or Junos OS Evolved device. The rpd routing process dereferences a NULL pointer while parsing the message and crashes, disrupting routing and causing a denial of service. No public exploit identified at time of analysis, and the attacker needs adjacency to the LMP control channel rather than remote internet access.