EUVD-2026-101364
GHSA-mrj7-7xm6-68qr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain adjacent network position
-
DeliveryCraft malicious RSVP Path message
-
ExploitTrigger NULL pointer dereference in rpd
-
ExecutionCrash routing daemon
-
ImpactRouting/MPLS denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target must have RSVP signaling enabled (typically deployed for MPLS traffic engineering / LSP setup); devices without RSVP configured are not exposed to this attack path. The attacker must be network-adjacent (AV:A) - reachable at Layer 2 or as a directly-connected routing neighbor able to deliver an RSVP Path message - which rules out arbitrary internet-based attackers and limits exploitation to those already inside the adjacency/peering domain. Per the CVSS vector no authentication (PR:N) and no user interaction (UI:N) are required once adjacency is achieved. Impact is confined to availability (routing daemon crash / DoS); there is no confidentiality or integrity exposure. |
| Impact | This is a genuine but bounded availability risk. The CVSS 4.0 vector (AV:A/AC:L/PR:N/UI:N) confirms an adjacent, low-complexity, unauthenticated attack requiring no user interaction, with impact limited to availability (VA:H) and no confidentiality or integrity loss (VC:N/VI:N) - consistent with a crash/DoS of the rpd routing daemon rather than code execution. The input reports no EPSS score, no CISA KEV listing, and no public POC, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The decisive limiting factor is the AV:A (adjacent) vector: the attacker must be on a directly-connected network segment or adjacent routing peer, not the open internet, which substantially narrows the realistic threat to an attacker who already has a foothold adjacent to the device. The input also carries 4.0 supplemental/threat metrics (notably AU:Y automatable and SA:L subsequent-system availability), implying the crash could be scripted and may degrade routing for downstream systems - relevant for carrier/core deployments where rpd outages ripple outward. Net: a legitimate patch-priority item for internet-facing routing infrastructure running RSVP, but not an emergency on par with a network-exploitable RCE; prioritize behind any unauthenticated remote-code-execution exposure. |
| Exploit ScenarioDerived | An attacker positioned on an adjacent network segment or as a (potentially unauthenticated) RSVP-speaking neighbor sends a specially crafted RSVP Path message to a Junos OS / Junos OS Evolved device that has RSVP signaling enabled. The malformed message triggers a NULL pointer dereference in the rpd routing daemon, crashing it and interrupting routing/MPLS traffic engineering until rpd restarts. No public exploit code is identified at time of analysis, and the adjacent (AV:A) vector means the attacker must already be in the device's Layer-2/routing adjacency domain. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Denial of service in Juniper Networks Junos OS and Junos OS Evolved allows a network-adjacent, unauthenticated attacker to crash the rpd routing daemon by sending a crafted RSVP Path message, disrupting routing on the affected device (CVSS 7.1; assessed CVSS:3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, availability-only impact). Exploitation is bounded: the target must have RSVP signaling enabled (typically for MPLS traffic engineering / LSP setup) and the attacker must be reachable at Layer 2 or act as a directly-connected routing neighbor able to inject RSVP control traffic, so arbitrary internet-based attackers are excluded. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, though the low attack complexity and the unauthenticated nature of the vector make the flaw attractive to anyone already inside the adjacency or peering domain.
RemediationAI
Juniper has published security advisory JSA112187 (https://supportportal.juniper.net/JSA112187); consult it for the fixed Junos OS and Junos OS Evolved releases applicable to each platform and software train, since the supplied CPE data uses wildcard version fields and no exact fix version can be confirmed from this dataset. Where the fixed release cannot be deployed immediately, the most effective compensating control is to disable RSVP signaling on interfaces and devices that do not require MPLS traffic engineering - the trade-off is that doing so tears down or prevents RSVP-TE LSPs, so this is only viable where traffic engineering is not in use. On devices that must keep RSVP, restrict reachability of the control plane by applying a firewall filter (lo0 filter) that accepts RSVP (IP protocol 46) only from explicitly expected neighbor addresses, and enable RSVP authentication (MD5-based RSVP authentication keys between peers) - both measures shrink the Layer 2 / adjacent-neighbor attack surface but require coordinated configuration across peers and can break legitimate signaling, adjacency formation, or reconvergence if the key or filter list is incomplete or mismatched. Rate-limiting RSVP control traffic at the control plane policer adds a further barrier to repeated crash attempts at the cost of potentially delaying legitimate LSP setup under high signaling load. Note that these are mitigations, not fixes; only vendor patched firmware removes the NULL pointer dereference in rpd.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is a NULL pointer dereference (CWE-476) in rpd, the Junos routing protocol daemon that runs all routing protocol state machines - including RSVP - on Junos OS and Junos OS Evolved (the Linux-based, modular next-generation Junos variant). RSVP (Resource Reservation Protocol, RFC 2205) is the signaling protocol used to establish MPLS traffic-engineering label-switched paths; a Path message is the first message a sender issues to instantiate an LSP, and it is processed by the transit/egress node without any prior authentication handshake, which is why the CVSS vector carries PR:N and UI:N. Malformed or unexpected Path message contents drive rpd into dereferencing a pointer that has not been populated, causing the daemon process to abort. Because rpd owns the routing protocol adjacencies rather than the packet forwarding plane, the immediate effect is a daemon crash and a control-plane/availability event rather than data-plane packet loss; recovery depends on the daemon restart and adjacency reconvergence. The affected product set is identified by the CPE entries cpe:2.3:a:juniper_networks:junos_os (version wildcard) and cpe:2.3:a:juniper_networks:junos_os_evolved (version wildcard); the wildcards mean the specific vulnerable and fixed version boundaries must be read from Juniper's JSA112187 rather than inferred from the CPE. Consistent with the independent assessment, there is no confidentiality or integrity exposure - the weakness is confined to process stability.
Know when Junos Os gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M
Adjacent RSVP peer reach gives AV:A with low complexity and no auth (PR:N); impact is a daemon crash so A:H with C:N/I:N and scope unchanged.
Primary rating from Vendor (juniper).
CVSS VectorVendor: juniper
Lifecycle Timeline
4DescriptionCVE.org
A NULL Pointer Dereference vulnerability in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to crash the routing daemon and cause a denial of service via an RSVP Path message.
Executive ViewAI
Juniper Networks Junos OS and Junos OS Evolved contain a high-severity denial-of-service vulnerability that enables a network-adjacent, unauthenticated attacker to crash the rpd routing daemon, potentially disrupting routing and causing network outages. This affects organizations using Juniper devices with RSVP signaling enabled for MPLS traffic engineering, though exploitation requires the attacker to be directly connected or on the same Layer 2 segment. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but leadership should prioritize mitigation because a routing outage can impact critical business services and customer connectivity.
No vendor-released patch identified at time of analysis. Interim mitigations include disabling RSVP signaling on devices where not required, restricting RSVP control traffic to trusted routing neighbors via infrastructure ACLs, and monitoring rpd process health for unexpected crashes.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
OS command injection in the phcd phone-home daemon of Juniper Networks Junos OS and Junos OS Evolved lets an adjacent, u
Unauthenticated remote code execution with root privileges affects Juniper Networks Junos OS devices that expose the J-W
Heap-based buffer overflow in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allow
A stack-based buffer overflow in the srxpfe packet forwarding process of Juniper Networks Junos OS on SRX Series devices
Unauthenticated remote code execution with elevated privileges is possible in Juniper Junos OS and Junos OS Evolved thro
Remote root code execution in the routing protocol daemon (rpd) of Juniper Junos OS is reachable through protocol-valid
Remote code execution (on Junos OS) and rpd denial of service (on Junos OS and Junos OS Evolved) result from a stack-bas
Remote code execution with root privileges on Juniper Networks Junos OS and Junos OS Evolved is possible when the routin
Remote code execution and denial of service in Juniper Networks Junos OS and Junos OS Evolved arise from a stack-based b
Unauthenticated remote attackers can gain root-level configuration access and fully compromise Juniper Junos OS and Juno
Integer underflow in the Junos OS kernel can crash a device when the Extended Echo feature (RFC 8335 ICMP probing) is co
Heap-based buffer overflow in Juniper Networks Junos OS on SRX Series devices that have Secure Vector Routing (SVR) enab
Exploit-DB