A NULL Pointer Dereference in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a malicious actor to cause rpd to crash by sending a crafted RSVP packet when MPLS-TE RSVP processing is enabled. The resulting crash terminates rpd and disrupts routing protocol sessions, effectively denying network reachability for the affected device. This vulnerability is classified as CWE-476, indicating an improper handling of null pointers that can lead to service disruption.

The vulnerability affects Juniper Networks Junos OS and Junos OS Evolved. Revoked and updated releases include Junos OS 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1 and all subsequent releases, as well as Junos OS Evolved 24.4R2‑S5‑EVO, 25.2R2‑S2‑EVO, 25.2X100‑D35‑EVO, 25.4R1‑S3‑EVO, 25.4R2‑EVO, 25.4X300‑D40‑EVO, 26.2R1‑S2‑EVO, 26.2R2‑EVO, 26.4R1‑EVO and all subsequent releases.

The CVSS score of 7.1 indicates moderate-to-high severity. EPSS score indicates a very low but nonzero probability of exploitation (<1%), and the vulnerability is not listed in the CISA KEV catalog. Attacks require an adjacent network that can inject malformed RSVP packets; the router must have MPLS-TE RSVP processing turned on for the flaw to be triggered. The crash terminates rpd, breaking critical routing and causing a denial of service that impacts the entire network segment which relies on that device.