Description
A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via LDP messages received over an operational LDP session.
Published: 2026-10-14
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Patch Now
AI Analysis

Impact

A NULL Pointer Dereference occurs in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. The flaw allows an unauthenticated adjacent attacker to send crafted LDP messages over an operational LDP session, causing rpd to crash and resulting in a denial of service. The vulnerability is linked to CWE-476 and requires LDP to be enabled on the affected device.

Affected Systems

Affected vendors are Juniper Networks. The products impacted are Junos OS and Junos OS Evolved. The vulnerability affects the following releases: Junos OS 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1, and all subsequent releases; Junos OS Evolved 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO, and all subsequent releases.

Risk and Exploitability

The CVSS score of 7.1 indicates a moderate severity denial of service vulnerability. EPSS score of <1% indicates a very low exploitation probability. The issue is not listed in the CISA KEV catalog. The attack requires the device to have LDP enabled and to be reachable by an adjacent attacker on the same network segment; the attacker does not need authentication. Because the flaw causes a crash of rpd, the impact is a temporary service interruption for routing operations.

Generated by OpenCVE AI on October 15, 2026 at 16:48 UTC.

Remediation

Vendor Solution

The following software releases have been updated to resolve this specific issue: Junos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1, and all subsequent releases. Junos OS Evolved: 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO, and all subsequent releases. Note: For Junos OS releases 23.2, 23.4, and 24.2, and Junos OS Evolved releases 23.2-EVO, 23.4-EVO, and 24.2-EVO, specific respins have been referenced. Previously published versions of these releases have been rebuilt to resolve the security vulnerabilities identified in this advisory.

Vendor Workaround

There are no known workarounds for this issue.

OpenCVE Recommended Actions

  • Apply one of the patched Junos OS or Junos OS Evolved releases listed in the advisory or any subsequent release.
  • Disable the LDP protocol on devices where it is not necessary or restrict LDP traffic to trusted interfaces only with firewall rules.
  • Continuously monitor rpd process and LDP traffic logs for crashes or suspicious activity.

Generated by OpenCVE AI on October 15, 2026 at 16:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 10 Nov 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 16 Oct 2026 23:30:00 +0000

Type Values Removed Values Added
First Time appeared Juniper Networks
Juniper Networks junos Os
Juniper Networks junos Os Evolved
Vendors & Products Juniper Networks
Juniper Networks junos Os
Juniper Networks junos Os Evolved

Wed, 14 Oct 2026 16:45:00 +0000

Type Values Removed Values Added
Description A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via LDP messages received over an operational LDP session.
Title Junos OS and Junos OS Evolved: An unauthenticated adjacent attacker causes an rpd crash when LDP is enabled
Weaknesses CWE-476
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L'}

Subscriptions

Juniper Networks Junos Os Junos Os Evolved
cve-icon MITRE

Status: PUBLISHED

Assigner: juniper

Published:

Updated: 2026-10-14T20:15:55.196Z

Reserved: 2026-09-28T16:31:35.504Z

Link: CVE-2026-101988

cve-icon Vulnrichment

Updated: 2026-10-14T20:15:41.808Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-14T17:17:51.260

Modified: 2026-10-15T16:23:06.250

Link: CVE-2026-101988

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-16T23:15:14Z

Weaknesses