EUVD-2026-101472
GHSA-cwjh-j5fp-pm2g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain adjacent network position
-
ExploitCraft malicious RSVP packet
-
ExecutionTrigger reachable assertion in rpd
-
ImpactCrash routing daemon and disrupt routing
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V16 - Security Logging and Error Handling Reachable assertion handling
|
| Exploitation Conditions | The target Junos OS or Junos OS Evolved device must have the RSVP signaling protocol enabled (MPLS/RSVP-TE configuration) within rpd, since the crash is triggered by a specific RSVP packet - devices without RSVP configured are not on the vulnerable path. The attacker must occupy an adjacent network position (AV:A: same broadcast/L2 domain or a directly adjacent routing peer), not arbitrary remote Internet reach. No authentication and no user interaction are required (PR:N/UI:N). Limiting factors: the adjacency requirement and the non-default RSVP-TE dependency substantially narrow exposure, and impact is limited to denial of service (routing daemon crash) with no data compromise. |
| Impact | This is a moderate, not top-priority, issue whose real-world risk is tempered by its access and configuration prerequisites. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VA:H/SA:L, 7.1) tells a consistent story: exploitation is unauthenticated and low-complexity but requires ADJACENT network position (AV:A), not full remote Internet reach, and impact is confined to availability (VA:H) - a crash of the routing protocol daemon - with no confidentiality or integrity loss. The description and CWE-617 (Reachable Assertion) align cleanly with the vector; there is no network-vs-local conflict to flag. No EPSS score, KEV listing, or POC indicator is present in the input, so there is no evidence of active exploitation or public exploit code; the only strong positive signal is a vendor patch, implying the flaw is confirmed and fixed but not necessarily being attacked. Against default configurations the risk is lower still, because RSVP signaling must be enabled (MPLS/RSVP-TE) for the vulnerable path to be reachable. Net: a real, patch-worthy DoS for carriers and enterprises running RSVP-TE, but the adjacency requirement and availability-only impact keep it below the urgency of a remotely exploitable RCE. |
| Exploit ScenarioDerived | An attacker with a foothold on an adjacent network segment (e.g., a compromised device or peer in the same L2/routing adjacency as a Junos router running RSVP-TE) sends a specifically crafted RSVP packet to the target. The packet triggers a reachable assertion in the rpd daemon, causing it to crash and interrupt routing, producing a denial of service. No public exploit identified at time of analysis, and low attack complexity means a working trigger would be reliable once RSVP is in use. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 14, 2026
An unauthenticated attacker with an adjacent network position can crash the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved devices by sending a specifically crafted RSVP packet, producing a denial of service on affected routing platforms. The flaw is a reachable assertion (CWE-617) that only triggers when RSVP signaling is enabled - i.e., devices running MPLS RSVP-TE within rpd - so unconfigured devices are not on the vulnerable path, and no data confidentiality or integrity impact is involved. As of analysis, there is no CISA KEV listing and no public exploit identified at time of analysis; vendor patches are available, and the real-world risk is tempered by the adjacency and RSVP-configuration prerequisites, making this a moderate rather than top-priority issue.
Earlier versions of this analysis (1)
Malformed or unexpected RSVP signaling packets can trip a reachable assertion (CWE-617) inside the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved, terminating the daemon and producing a denial of service on the affected device. Only devices that have RSVP enabled - typically those running MPLS/RSVP-TE traffic engineering - are exposed, and the triggering attacker must be unauthenticated but adjacent (same segment, directly connected, or on an RSVP signaling adjacency), consistent with the assessed vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. No public exploit code was identified at time of analysis and the CVE is not listed in CISA KEV; this is a genuine but moderate-priority availability issue rather than a critical one, with the adjacency requirement and non-default RSVP configuration being the principal limiting factors.
RemediationAI
Vendor-released patches are available: upgrade Junos OS to 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, or 26.2R1-S2 (or later maintenance builds on those trains), and Junos OS Evolved to 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.4R1-S3-EVO, 26.2R1-S2-EVO, 25.2X100-D35-EVO, or 25.4X300-D40-EVO, per Juniper advisory JSA112187 (https://supportportal.juniper.net/JSA112187). If immediate upgrade is not possible, the most effective compensating control is to remove the device from the vulnerable path by disabling RSVP signaling on interfaces where MPLS RSVP-TE is not operationally required - this eliminates exposure entirely but breaks RSVP-TE LSP establishment and any MPLS traffic engineering or Fast Reroute functionality that depends on it. On interfaces where RSVP must remain enabled, apply Juniper firewall filters (or interface-level access lists) to drop RSVP (IP protocol 46) packets from untrusted adjacent sources, and restrict RSVP peering to explicitly known neighbors using RSVP authentication and neighbor allow-lists; the trade-off is added configuration complexity and the risk that a legitimate neighbor is accidentally filtered, causing signaling flaps. Since the exploit requires adjacency, segmenting the control plane so that only trusted routing peers share the L2/broadcast domain further reduces exposure. Monitor rpd for unexpected restarts as a detection signal, and note that no vendor-released patch is required for platforms that have never enabled RSVP.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is rpd, the Juniper routing protocol daemon that hosts routing and signaling protocols including RSVP, the resource reservation protocol used to establish MPLS RSVP-TE label-switched paths. The root cause is CWE-617 (Reachable Assertion): a specific RSVP packet drives the daemon into an assertion failure, and because rpd aborts on the failed assertion, all routing protocol processing on that device stops, yielding a denial of service. Both CPE branches are affected - cpe:2.3:a:juniper_networks:junos_os and cpe:2.3:a:juniper_networks:junos_os_evolved - meaning the flaw lives in shared rpd/RSVP signaling code across the classic Junos and the Linux-based Junos OS Evolved distributions. The CVSS:4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VA:H) and the independent reassessment (CVSS:3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) agree on the key characteristics: no prior attack complexity, no privileges, no user interaction, but an adjacent attack vector and high availability-only impact, with no confidentiality or integrity effect.
Know when Junos Os gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L
Adjacent unauthenticated trigger via crafted RSVP packet (AV:A/AC:L/PR:N/UI:N); impact is a routing-daemon DoS only, so C:N/I:N/A:H with scope unchanged.
Primary rating from Vendor (juniper).
CVSS VectorVendor: juniper
Lifecycle Timeline
4DescriptionCVE.org
A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via a specific RSVP packet.
Executive ViewAI
Juniper Networks Junos OS and Junos OS Evolved routing platforms that run MPLS RSVP-TE signaling can be forced into a denial-of-service condition by a malformed RSVP packet sent from an adjacent network position, crashing the routing protocol daemon and disrupting routed traffic. Only devices with RSVP signaling actively configured are exposed, so the blast radius is limited to specific segments of the network rather than the entire estate. Leadership should care because an outage on these routing platforms can interrupt connectivity for downstream business services, though the adjacency and configuration prerequisites make this a contained, manageable risk rather than an enterprise-wide emergency.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
OS command injection in the phcd phone-home daemon of Juniper Networks Junos OS and Junos OS Evolved lets an adjacent, u
Unauthenticated remote code execution with root privileges affects Juniper Networks Junos OS devices that expose the J-W
Heap-based buffer overflow in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allow
A stack-based buffer overflow in the srxpfe packet forwarding process of Juniper Networks Junos OS on SRX Series devices
Unauthenticated remote code execution with elevated privileges is possible in Juniper Junos OS and Junos OS Evolved thro
Remote root code execution in the routing protocol daemon (rpd) of Juniper Junos OS is reachable through protocol-valid
Remote code execution (on Junos OS) and rpd denial of service (on Junos OS and Junos OS Evolved) result from a stack-bas
Remote code execution with root privileges on Juniper Networks Junos OS and Junos OS Evolved is possible when the routin
Remote code execution and denial of service in Juniper Networks Junos OS and Junos OS Evolved arise from a stack-based b
Unauthenticated remote attackers can gain root-level configuration access and fully compromise Juniper Junos OS and Juno
Integer underflow in the Junos OS kernel can crash a device when the Extended Echo feature (RFC 8335 ICMP probing) is co
Heap-based buffer overflow in Juniper Networks Junos OS on SRX Series devices that have Secure Vector Routing (SVR) enab
Exploit-DB