Description
A Use After Free vulnerability in the rpd PIM Join/Prune processing of Juniper Networks Junos OS and Junos OS Evolved platforms allows an unauthenticated adjacent attacker to crash the routing daemon via specific PIM messages when sparse mode PIM is configured.
Published: 2026-10-14
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Patch
AI Analysis

Impact

The vulnerability is a Use After Free (CWE‑416) in the rpd PIM Join/Prune processing. An unauthenticated adjacent attacker can send specific PIM messages that crash the routing daemon, causing a denial of service on Junos OS and Junos OS Evolved. The crash prevents the routing process from functioning, potentially downing routing across the router until a restart.

Affected Systems

Affected systems include Juniper Networks Junos OS and Junos OS Evolved platforms. The vulnerability applies to the following releases: Junos OS 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1, and all subsequent releases; Junos OS Evolved 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO, and all subsequent releases.

Risk and Exploitability

The CVSS score of 7.1 indicates significant impact. EPSS score is < 1%, reflecting a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Because it can be triggered by an unauthenticated attacker on an adjacent network, it is a local network threat. Exploitation would involve sending crafted PIM Join/Prune packets to a router with sparse mode PIM enabled, which causes the routing daemon to crash. A crash results in a loss of routing function until the daemon recovers, leading to network outages. The lack of a workaround and the availability of patched releases underscore the need for rapid remediation.

Generated by OpenCVE AI on October 15, 2026 at 17:51 UTC.

Remediation

Vendor Solution

The following software releases have been updated to resolve this specific issue: Junos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1, and all subsequent releases. Junos OS Evolved: 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO, and all subsequent releases. Note: For Junos OS releases 23.2, 23.4, and 24.2, and Junos OS Evolved releases 23.2-EVO, 23.4-EVO, and 24.2-EVO, specific respins have been referenced. Previously published versions of these releases have been rebuilt to resolve the security vulnerabilities identified in this advisory.

Vendor Workaround

There are no known workarounds for this issue.

OpenCVE Recommended Actions

  • Upgrade to any of the patched Junos OS or Junos OS Evolved releases listed in the advisory.
  • If an upgrade cannot be performed immediately, isolate the affected router from untrusted adjacent networks by applying firewall rules or ACLs that block PIM Join/Prune traffic on all interfaces, effectively preventing the vulnerability from being triggered until a patch is installed.
  • Monitor router logs for crash events or abnormal PIM traffic and investigate any such events to determine if the vulnerability was triggered.

Generated by OpenCVE AI on October 15, 2026 at 17:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
First Time appeared Juniper Networks
Juniper Networks junos Os
Juniper Networks junos Os Evolved
Vendors & Products Juniper Networks
Juniper Networks junos Os
Juniper Networks junos Os Evolved

Thu, 15 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 14 Oct 2026 17:00:00 +0000

Type Values Removed Values Added
Description A Use After Free vulnerability in the rpd PIM Join/Prune processing of Juniper Networks Junos OS and Junos OS Evolved platforms allows an unauthenticated adjacent attacker to crash the routing daemon via specific PIM messages when sparse mode PIM is configured.
Title Junos OS and Junos OS Evolved: Specific PIM messages causes rpd crash when multiple-triggered-joins is used
Weaknesses CWE-416
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M'}

Subscriptions

Juniper Networks Junos Os Junos Os Evolved
cve-icon MITRE

Status: PUBLISHED

Assigner: juniper

Published:

Updated: 2026-10-14T20:15:54.079Z

Reserved: 2026-09-28T16:31:35.502Z

Link: CVE-2026-101970

cve-icon Vulnrichment

Updated: 2026-10-14T20:15:21.792Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-14T17:17:49.577

Modified: 2026-10-15T16:23:06.250

Link: CVE-2026-101970

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T22:15:12Z

Weaknesses