EUVD-2026-101318
GHSA-7544-9987-w8rg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessEstablish/abuse BGP peering session
-
DeliverySend crafted VPN-flowspec BGP update
-
ExploitUpdate readvertised with BMP RIB-out monitoring
-
ExecutionTrigger NULL pointer dereference in rpd
-
ImpactCrash routing daemon, denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the attacker be an established BGP neighbor of the target Junos OS / Junos OS Evolved device (unauthenticated to the device per PR:N, but a configured peering relationship is needed). The crash only occurs when a VPN-flowspec BGP update is readvertised AND the device is configured with BMP (BGP Monitoring Protocol) post-policy RIB-out monitoring - this is a non-default feature that must be explicitly enabled. Limiting factors: devices without BMP post-policy RIB-out monitoring, or without VPN-flowspec readvertisement, are not exploitable; impact is availability-only (rpd denial of service), with no confidentiality or integrity effect. |
| Impact | This is a genuine but conditional priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores 8.7 High and reflects pure availability impact (VA:H, VC:N/VI:N) - a routing-daemon (rpd) crash causing denial of service, consistent with CWE-476. No EPSS score, SSVC decision, KEV listing, or POC was provided, so exploitation-probability signals are entirely absent rather than low. The vendor-supplied PR:N is technically accurate (no authentication to the device is required), but it understates the real-world barrier: the attacker must already be an established BGP neighbor of the target, and exploitation only triggers when a VPN-flowspec update is readvertised AND BMP post-policy RIB-out monitoring is configured. That non-default monitoring requirement sharply narrows the exploitable population, so despite the high base score this behaves more like a targeted, configuration-dependent issue than a broadly wormable one. No conflicting data vector/description mismatch exists here (both agree on remote, unauthenticated-to-device, availability-only impact), but the EPSS/KEV/POC fields are simply missing - treat exploitation likelihood as unknown, not low. |
| Exploit ScenarioDerived | An attacker controlling (or having compromised) a device that is a configured BGP peer of a vulnerable Junos router sends a specially crafted VPN-flowspec BGP update. When that update is readvertised and the target has BMP post-policy RIB-out monitoring enabled, rpd dereferences a NULL pointer and crashes, disrupting routing. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
A crafted VPN-flowspec BGP update can crash the routing protocol daemon (rpd) on Juniper Junos OS and Junos OS Evolved, causing a denial of service, but only when that update is readvertised by the device and BMP post-policy RIB-out monitoring is explicitly configured. The flaw is a NULL pointer dereference (CWE-476) reachable by a remote BGP peer that already has an established peering session with the target (PR:N means no device-level authentication is required, but a configured neighbor relationship is a practical prerequisite). The vendor rates it 8.7 under CVSS 4.0 while our independent assessment scores it 7.5 under CVSS 3.1 (AC:H), reflecting the non-default BMP configuration and readvertisement conditions; impact is availability-only with no confidentiality or integrity effect, and no public exploit code has been identified at time of analysis.
RemediationAI
Vendor patches are available; upgrade to the fixed maintenance release that matches your train. On Junos OS this means 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, or 26.2R1-S2 (or later). On Junos OS Evolved the corresponding fixed builds are 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.4R1-S3-EVO, 26.2R1-S2-EVO, plus 25.2X100-D35-EVO and 25.4X300-D40-EVO in the extended-release trains; consult Juniper JSA112187 (https://supportportal.juniper.net/JSA112187) for the exact build for any additional affected release before scheduling maintenance. If immediate upgrade is not possible, remove the condition that makes the crash reachable: disable BMP post-policy RIB-out monitoring (for example by removing the post-policy RIB-out statement from the BMP configuration), accepting the loss of outbound post-policy route telemetry to monitoring collectors; additionally, if VPN-flowspec readvertisement is not operationally required on the device, stop readvertising VPN-flowspec routes, accepting that downstream peers will no longer receive those reachability/policy advertisements. As a lower-preference compensating control, tighten BGP peer authentication and neighbor filtering (MD5/TCP-AO where supported and import policies that drop unexpected VPN-flowspec NLRIs from untrusted peers) to raise the bar for a malicious or compromised peering session - this does not eliminate the bug and only limits who can reach it, so it should be treated as temporary until patched.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability lives in rpd, the Juniper routing protocol daemon that maintains BGP and other routing adjacencies, and is classified as CWE-476 (NULL Pointer Dereference). The trigger path involves BGP VPN-flowspec NLRIs (flowspec carried in a VPN context, per the flowspec/VPN-flowspec address-family extensions) that are received from a neighbor and then readvertised to other peers, combined with BMP (BGP Monitoring Protocol, RFC 7854) configured in post-policy RIB-out mode, which causes the daemon to encode outbound adj-RIBs-out state for monitoring collectors. When the two features intersect, an internal data structure associated with the VPN-flowspec route is dereferenced without a validity check, producing a NULL pointer dereference that terminates rpd and disrupts routing on the device. CPE data confirms both code bases are affected: the modular, Linux-based Junos OS Evolved (cpe:2.3:a:juniper_networks:junos_os_evolved) and the FreeBSD-based Junos OS (cpe:2.3:a:juniper_networks:junos_os), so both the classic and Evolved branches of the same routing stack require fixes. Because the defect is in the monitoring/encoding path rather than in policy installation itself, exploitation is conditional on a feature combination rather than on any single default-enabled capability.
Know when Junos Os gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L
AV:N and PR:N as a BGP peer needs no device auth; AC:H because exploitation depends on non-default BMP post-policy RIB-out monitoring and readvertisement; availability-only impact (A:H).
Primary rating from Vendor (juniper).
CVSS VectorVendor: juniper
Lifecycle Timeline
3DescriptionCVE.org
A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated remote BGP neighbor to cause a denial of service via a VPN-flowspec BGP update if it is readvertised and BMP post-policy RIB-out monitoring is configured.
Executive ViewAI
A high-severity availability flaw in Juniper Junos OS and Junos OS Evolved allows a remote BGP peer to crash the routing protocol daemon (rpd), which can take down routing and disrupt network connectivity on affected routers and switches. Exposure is limited to environments where BMP post-policy RIB-out monitoring is explicitly configured alongside BGP flowspec, so the population at risk is a subset of the Juniper estate rather than all deployments. Because a single crafted update can terminate rpd, leadership should prioritize inventorying Juniper devices with this non-default monitoring configuration and confirm patching status, as no public exploit code has been identified at time of analysis and no data confidentiality or integrity is at stake.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
OS command injection in the phcd phone-home daemon of Juniper Networks Junos OS and Junos OS Evolved lets an adjacent, u
Unauthenticated remote code execution with root privileges affects Juniper Networks Junos OS devices that expose the J-W
Heap-based buffer overflow in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allow
A stack-based buffer overflow in the srxpfe packet forwarding process of Juniper Networks Junos OS on SRX Series devices
Unauthenticated remote code execution with elevated privileges is possible in Juniper Junos OS and Junos OS Evolved thro
Remote root code execution in the routing protocol daemon (rpd) of Juniper Junos OS is reachable through protocol-valid
Remote code execution (on Junos OS) and rpd denial of service (on Junos OS and Junos OS Evolved) result from a stack-bas
Remote code execution with root privileges on Juniper Networks Junos OS and Junos OS Evolved is possible when the routin
Remote code execution and denial of service in Juniper Networks Junos OS and Junos OS Evolved arise from a stack-based b
Unauthenticated remote attackers can gain root-level configuration access and fully compromise Juniper Junos OS and Juno
Integer underflow in the Junos OS kernel can crash a device when the Extended Echo feature (RFC 8335 ICMP probing) is co
Heap-based buffer overflow in Juniper Networks Junos OS on SRX Series devices that have Secure Vector Routing (SVR) enab
Exploit-DB