Junos OS EUVD-2026-101316

Exploitation requires the device to be running LDP (MPLS label distribution) with an already-established LDP session, and the attacker must occupy an adjacent network position able to send LDP packets into that session (AV:A) - i.e., a neighboring or peered router or a host on the LDP peering path. Devices without MPLS/LDP configured are not exposed. Limiting factors: the adjacency requirement (not reachable from arbitrary internet hosts), dependence on a pre-existing LDP session, and the impact being confined to an rpd availability loss (no confidentiality or integrity impact); LDP session protections such as interface restrictions and TCP-AO/MD5 authentication further constrain who can reach the session.

This is a moderate-severity denial-of-service issue (vendor CVSS 4.0 base 7.1, AV:A/AC:L/PR:N/UI:N with VA:H and subsequent-availability SA:L), not a code-execution or data-exposure flaw - the only impact is an rpd (routing protocol daemon) crash. Several signals temper the raw score: the attack vector is Adjacent (AV:A), not Network, and exploitation requires an already-established LDP session, so the attacker must be a participating LDP/MPLS peer rather than an arbitrary remote host. No EPSS score, CISA KEV listing, or public POC is present in the supplied data, so there is no evidence of active exploitation or widespread weaponization; this reads as a real priority for MPLS-enabled service-provider and large-enterprise edge/core routers but a non-issue for devices not running LDP. Note a tension worth flagging: the vendor rates PR:N (unauthenticated), yet the description requires an 'established LDP session,' which in practice implies the attacker already holds an adjacent LDP peering relationship - assess the exposure of your LDP sessions (interface/peer filtering, MD5/TCP-AO authentication) rather than treating this as internet-wide unauthenticated.

An attacker positioned as an adjacent LDP peer (or who can inject into an established LDP session) on an MPLS-enabled Junos device sends a crafted LDP packet that trips a reachable assertion in rpd, crashing the routing protocol daemon and disrupting routing and label distribution. Because the vector is Adjacent (AV:A) with low complexity and no privileges per the vendor vector, a malicious or compromised neighboring router could repeatedly trigger the crash for a sustained DoS. No public exploit code was identified at time of analysis.