Description
A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated configured MSDP peer or adjacent PIM sender to cause a denial of service via an MSDP or PIM policy that uses AS-path expansion.
Published: 2026-10-14
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: Denial of Service on Juniper routing daemon
Action: Patch
AI Analysis

Impact

A null pointer dereference in the routing protocol daemon allows an unauthenticated MSDP peer or adjacent PIM sender to trigger a crash when an MSDP or PIM policy performs AS-path expansion. The resulting denial of service disrupts routing updates, potentially causing loss of network reachability and degraded service for the affected device.

Affected Systems

Juniper Networks Junos OS and Junos OS Evolved devices running the following releases are impacted: Junos OS 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1, and all later releases; Junos OS Evolved 23.2R2-S7.7‑EVO, 23.4R2-S8.11‑EVO, 24.2R2-S5.6‑EVO, 24.4R2-S5‑EVO, 25.2R2-S2‑EVO, 25.2X100-D35‑EVO, 25.4R1-S3‑EVO, 25.4R2‑EVO, 25.4X300-D40‑EVO, 26.2R1-S2‑EVO, 26.2R2‑EVO, 26.4R1‑EVO, and all later releases.

Risk and Exploitability

The vulnerability carries a CVSS score of 8.7, indicating high severity, and is not listed in the CISA KEV catalog. Exploitability is limited to an unauthenticated but configured MSDP peer or adjacent PIM sender, so an attacker must establish routing protocol connectivity. With current information there is no known EPSS score, but the high CVSS suggests the risk of exploitation remains significant until the device is patched or the vulnerable protocols are disabled.

Generated by OpenCVE AI on October 14, 2026 at 21:57 UTC.

Remediation

Vendor Solution

The following software releases have been updated to resolve this specific issue: Junos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1, and all subsequent releases. Junos OS Evolved: 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO, and all subsequent releases. Note: For Junos OS releases 23.2, 23.4, and 24.2, and Junos OS Evolved releases 23.2-EVO, 23.4-EVO, and 24.2-EVO, specific respins have been referenced. Previously published versions of these releases have been rebuilt to resolve the security vulnerabilities identified in this advisory.

Vendor Workaround

There are no known workarounds for this issue.

OpenCVE Recommended Actions

  • Upgrade Junos OS to any release newer than or equal to 23.2R2‑S7.7 and upgrade Junos OS Evolved to any release newer than or equal to 23.2R2‑S7.7‑EVO
  • If a patch cannot be applied immediately, disable MSDP or PIM protocols that use AS‑path expansion or restrict them to trusted neighbors only
  • Validate configuration changes to ensure no unintended null pointer references may be introduced during future updates

Generated by OpenCVE AI on October 14, 2026 at 21:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 14 Oct 2026 17:00:00 +0000

Type Values Removed Values Added
Description A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated configured MSDP peer or adjacent PIM sender to cause a denial of service via an MSDP or PIM policy that uses AS-path expansion.
Title Junos OS and Junos OS Evolved: An attacker causes routing-daemon denial of service when an MSDP or PIM policy uses AS-path expansion
Weaknesses CWE-476
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: juniper

Published:

Updated: 2026-10-14T16:49:19.421Z

Reserved: 2026-09-28T17:33:49.411Z

Link: CVE-2026-102029

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-14T17:17:56.303

Modified: 2026-10-14T17:17:56.303

Link: CVE-2026-102029

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-14T22:00:09Z

Weaknesses