EUVD-2026-101442
GHSA-6mqg-fmqw-35c3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessEstablish/compromise configured eBGP peering session
-
DeliveryCraft specific malicious BGP packet
-
ExploitTrigger NULL pointer dereference in rpd
-
ExecutionRouting daemon crashes persistently
-
ImpactRouting/network denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to be an already-configured eBGP peer of the target router (an established BGP trust relationship, not an arbitrary internet host), AND the target must be running with ephemeral configuration in use - a specific, non-universal configuration mode. Given those prerequisites, a single specific BGP packet triggers the crash with no user interaction. The limiting factors are therefore: the peering relationship requirement and the dependency on the ephemeral-configuration feature being enabled; routers not using ephemeral configuration, or that do not peer with the attacker-controlled device, are not exploitable. Impact is limited to availability (persistent rpd denial of service); there is no confidentiality or integrity exposure. |
| Impact | This is a genuine but conditional priority rather than a blanket emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) scores 8.7 (High) and reflects a network-reachable, low-complexity availability attack with no modeled authentication, and VA:H/SA:L capture a persistent crash of the routing daemon with limited downstream impact. However, the description constrains the attacker to a 'configured eBGP peer' and the target to a deployment that 'uses ephemeral configuration' - two prerequisites the PR:N/AC:L metrics do not express, so the CVSS vector overstates how open-ended exploitation is: the attacker must already sit in an established BGP trust relationship and the specific ephemeral-config feature must be active. No EPSS score, CISA KEV listing, or public POC is present in the input, so there is no signal of active or imminent mass exploitation. Confidentiality and integrity are untouched (VC:N/VI:N) - this is purely a denial-of-service/availability issue. Net: patch-worthy for operators running eBGP with ephemeral configuration (especially carriers/ISPs where rpd uptime is critical), but not a drop-everything internet-wide worm risk given the peering and configuration preconditions. |
| Exploit ScenarioDerived | An attacker who controls or compromises a device that is an already-configured eBGP peer of a vulnerable Junos OS or Junos OS Evolved router sends a single crafted BGP packet, dereferencing a NULL pointer in rpd and crashing the routing-protocol daemon, causing a persistent routing outage. No public exploit code or active exploitation is identified at time of analysis, and the attack only succeeds when the target is using ephemeral configuration. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 14, 2026
Persistent routing-daemon denial of service affects Juniper Networks Junos OS and Junos OS Evolved: a single specially crafted BGP packet crashes rpd (NULL pointer dereference, CWE-476) when the device is running with ephemeral configuration in use, and the targeted router must already have the sending device established as an eBGP peer. The CVSS 4.0 base score is 8.7 with PR:N, i.e. no authentication is required from the network perspective, but exploitation is bounded by two real prerequisites - an existing BGP peering/trust relationship and the ephemeral-configuration feature being active - so routers that do not peer with the attacker or that do not use ephemeral configuration are not exposed. Impact is availability only (rpd restart/crash cycle with no confidentiality or integrity loss); there is no public exploit identified at time of analysis, and CISA KEV does not list this issue. A vendor fix is available.
Earlier versions of this analysis (1)
A NULL pointer dereference in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP peer to cause a persistent denial of service of the routing daemon by sending a specific BGP packet when ephemeral configuration is in use. Although the CVSS vector rates this as unauthenticated (PR:N), exploitation is conditional: the attacker must already be a configured eBGP peer of the target, and the target must have ephemeral configuration enabled; devices not using ephemeral configuration are not affected. No public exploit code or confirmed active exploitation has been identified at the time of analysis; the impact is availability-only, causing an rpd crash with no confidentiality or integrity exposure.
RemediationAI
Vendor-released patches are available per the Juniper advisory (https://supportportal.juniper.net/JSA112187); upgrade to the fixed build for your train - Junos OS 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3 or 26.2R1-S2, and Junos OS Evolved 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.4R1-S3-EVO, 26.2R1-S2-EVO, 25.2X100-D35-EVO or 25.4X300-D40-EVO. If patching must be deferred, the most effective compensating control is to remove the attack precondition: stop using ephemeral configuration on BGP-speaking routers (or restrict it to maintenance windows), since the vulnerable code path is only reachable when that feature is active - the trade-off is loss of the transient/rollback configuration workflow those operators rely on. Second, tighten BGP peering hygiene: only permit eBGP sessions from explicitly authorized, controlled peer addresses via import/export policy and TCP/179 filters, and treat any eBGP peer as a potential denial-of-service source - this does not eliminate the bug but removes unmanaged peers from the blast radius. Third, reduce blast radius and improve recovery by enabling and monitoring routing-engine daemon restart/backup functionality and logging rpd core dumps so crashes are detected immediately, accepting the resource cost of backup routing-engine redundancy. There is no identified mitigation that blocks the specific BGP packet itself, so upgrades remain the definitive fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a NULL pointer dereference (CWE-476) inside rpd, the routing protocol daemon that implements BGP and other routing protocols on Juniper Networks Junos OS and Junos OS Evolved. A dereference of an uninitialized or absent pointer occurs while processing a specific BGP packet in a code path that is only reachable when ephemeral configuration is in use - a Junos feature that allows transient configuration state to be committed and rolled back. Because the malformed condition is not validated before use, rpd terminates, and repeated packets from the still-configured peer can keep the daemon in a crash/restart loop, producing what the advisory describes as a persistent routing-daemon denial of service. The CPE data confirms both the classic Junos OS and the Evolved (Linux-based) releases are affected. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H, adjacent/integrity/confidentiality impacts None) aligns with the independent assessment of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - network-reachable, low complexity, availability-high, no data exposure.
Know when Junos Os gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L
Crafted BGP packet over the network with no modeled auth (though an established eBGP peer is required) and only availability impact from the rpd crash, so C:N/I:N/A:H.
Primary rating from Vendor (juniper).
CVSS VectorVendor: juniper
Lifecycle Timeline
3DescriptionCVE.org
A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP peer to cause a persistent routing-daemon denial of service via a specific BGP packet when ephemeral configuration is used.
Executive ViewAI
A high-severity availability flaw in Juniper Networks' Junos OS and Junos OS Evolved routing daemon (rpd) allows a single crafted BGP packet to crash the process on routers that both maintain an established eBGP peering with the sender and are running with ephemeral configuration active. Because rpd is the routing control plane, an affected device can enter a crash-restart cycle that disrupts routing and any business services dependent on that network path; there is no confidentiality or integrity loss, so the exposure is operational rather than data-related. Leadership should care because the affected assets are typically core network infrastructure whose failure cascades to customers and internal operations, though the two prerequisites mean exposure is confined to a definable subset of the fleet rather than the entire estate.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
OS command injection in the phcd phone-home daemon of Juniper Networks Junos OS and Junos OS Evolved lets an adjacent, u
Unauthenticated remote code execution with root privileges affects Juniper Networks Junos OS devices that expose the J-W
Heap-based buffer overflow in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allow
A stack-based buffer overflow in the srxpfe packet forwarding process of Juniper Networks Junos OS on SRX Series devices
Unauthenticated remote code execution with elevated privileges is possible in Juniper Junos OS and Junos OS Evolved thro
Remote root code execution in the routing protocol daemon (rpd) of Juniper Junos OS is reachable through protocol-valid
Remote code execution (on Junos OS) and rpd denial of service (on Junos OS and Junos OS Evolved) result from a stack-bas
Remote code execution with root privileges on Juniper Networks Junos OS and Junos OS Evolved is possible when the routin
Remote code execution and denial of service in Juniper Networks Junos OS and Junos OS Evolved arise from a stack-based b
Unauthenticated remote attackers can gain root-level configuration access and fully compromise Juniper Junos OS and Juno
Integer underflow in the Junos OS kernel can crash a device when the Extended Echo feature (RFC 8335 ICMP probing) is co
Heap-based buffer overflow in Juniper Networks Junos OS on SRX Series devices that have Secure Vector Routing (SVR) enab
Exploit-DB