Junos OS EUVD-2026-101365

Exploitation requires that RSVP signaling be enabled on the target Junos OS / Junos OS Evolved device (typically in MPLS traffic-engineering deployments) - devices without RSVP configured are not affected. The attacker must occupy an adjacent network position (AV:A): same logical/physical link or adjacent L2 segment capable of delivering RSVP signaling to rpd, not arbitrary internet reachability. No authentication is required (PR:N) and no user interaction (UI:N), but the adjacency requirement and the non-default RSVP dependency are the primary limiting factors. Impact is limited to denial of service against the routing daemon; there is no data exposure or code execution.

This is a genuine but bounded operational risk, not a critical priority. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) confirms an adjacent-network, low-complexity, unauthenticated attack with no user interaction - easy to trigger for anyone with the required network position. However, impact is availability-only (VC:N/VI:N/VA:H, SA:L): a routing-daemon crash/DoS with no confidentiality or integrity loss, which caps the vendor score at 7.1 (High). Two factors meaningfully reduce real-world exposure: the attack vector is Adjacent (AV:A), so the attacker must already be on the same L2/adjacent network segment rather than exploiting across the internet, and the vulnerable RSVP signaling must be explicitly enabled (RSVP is used in MPLS/traffic-engineering deployments, not a universal default). No EPSS score, KEV listing, or public POC was provided in the input, so there is no signal of active or imminent exploitation. The vector's R:A (automatic recovery - rpd typically restarts) further limits durable impact to transient routing disruption rather than permanent outage. Net: patch on a normal maintenance cadence for MPLS/RSVP-enabled devices; it does not warrant emergency out-of-band action absent new exploitation evidence.

An attacker positioned on a network segment adjacent to a Junos OS or Junos OS Evolved device with RSVP enabled sends malformed RSVP signaling messages to the rpd routing daemon. The malformed input reaches an assertion that causes rpd to crash, disrupting routing/MPLS traffic engineering until the daemon recovers. No public exploit code was identified at time of analysis, and exploitation requires adjacent network access rather than remote internet reachability.