Juniper Junos OS EUVD-2026-101483

Exploitation requires BOTH the SRv6 feature AND Flexible Algorithm to be explicitly enabled on the Junos OS / Junos OS Evolved device - this is a non-default IS-IS/SRv6 segment-routing configuration, so routers not running SRv6 Flex-Algo are not exploitable at all. The attacker must also hold an adjacent-network position (AV:A): specifically the ability to inject IS-IS SRv6 packets onto a link where the router participates in the IS-IS domain, meaning a directly connected or same-segment adversary (e.g., compromised peer or Layer-2 neighbor), not a remote Internet attacker. No authentication is required (PR:N) and no user interaction (UI:N), but the combination of adjacency plus the specific feature enablement substantially narrows the real exposed population.

This is a moderate-severity, availability-only denial-of-service flaw whose real-world priority is constrained by both its attack position and its configuration prerequisites. The vendor-supplied CVSS 4.0 vector (AV:A/AC:L/PR:N/UI:N) rates it 7.1 with VA:H and SA:L, meaning an unauthenticated attacker on the adjacent network segment can crash the routing daemon with no user interaction - but AV:A (adjacent, not network) already limits this to an attacker with Layer-2/IS-IS adjacency to the victim router, not a remote Internet attacker. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so this is 'no public exploit identified at time of analysis'; exploitation status is purely theoretical based on the vendor advisory. The impact is confined to availability (C:N/I:N, VA:H, SA:L) - there is no data disclosure or code execution. The most important limiting signal, absent from the raw CVSS score, is that the vulnerable code path is only reachable when SRv6 AND Flexible Algorithm are both enabled, which is a non-default, feature-specific deployment. Net assessment: a genuine but lower-priority DoS for the subset of Juniper operators running SRv6 Flex-Algo in IS-IS; for everyone else the attack surface does not exist. No conflicting signals were detected, though the CWE is listed as N/A and CWE-789/CWE-1284-style 'improper validation of specified quantity' is inferred only from the description.

An attacker who has gained a foothold on a device sharing an IS-IS adjacency with a vulnerable Junos router (e.g., a compromised peer router or a host on the same broadcast segment) crafts and sends a malformed IS-IS SRv6 packet. On a router where SRv6 and Flexible Algorithm are enabled, the rpd routing daemon mishandles the specified quantity in the packet and crashes, disrupting routing. No public exploit code is identified in the available data, so any attack would require the adversary to develop the trigger from the advisory.