Description
A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated configured MSDP peer or adjacent PIM sender to cause a denial of service via an MSDP or PIM policy that uses AS-path expansion.
Published: 2026-10-14
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service on Juniper routing daemon
Action: Patch
AI Analysis

Impact

A null pointer dereference in the routing protocol daemon allows an unauthenticated MSDP peer or adjacent PIM sender to trigger a crash when an MSDP or PIM policy performs AS-path expansion. The resulting denial of service disrupts routing updates, potentially causing loss of network reachability and degraded service for the affected device.

Affected Systems

Juniper Networks Junos OS and Junos OS Evolved devices running the following releases are impacted: Junos OS 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1, and all later releases; Junos OS Evolved 23.2R2-S7.7‑EVO, 23.4R2-S8.11‑EVO, 24.2R2-S5.6‑EVO, 24.4R2-S5‑EVO, 25.2R2-S2‑EVO, 25.2X100-D35‑EVO, 25.4R1-S3‑EVO, 25.4R2‑EVO, 25.4X300-D40‑EVO, 26.2R1-S2‑EVO, 26.2R2‑EVO, 26.4R1‑EVO, and all later releases.

Risk and Exploitability

The vulnerability carries a CVSS score of 8.7, indicating high severity, and is not listed in the CISA KEV catalog. Exploitability is limited to an unauthenticated but configured MSDP peer or adjacent PIM sender, so an attacker must establish routing protocol connectivity. The EPSS score is <1%, indicating a low but non-zero probability of exploitation; the high CVSS suggests the risk remains significant until the device is patched or the vulnerable protocols are disabled.

Generated by OpenCVE AI on October 15, 2026 at 16:13 UTC.

Remediation

Vendor Solution

The following software releases have been updated to resolve this specific issue: Junos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1, and all subsequent releases. Junos OS Evolved: 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO, and all subsequent releases. Note: For Junos OS releases 23.2, 23.4, and 24.2, and Junos OS Evolved releases 23.2-EVO, 23.4-EVO, and 24.2-EVO, specific respins have been referenced. Previously published versions of these releases have been rebuilt to resolve the security vulnerabilities identified in this advisory.

Vendor Workaround

There are no known workarounds for this issue.

OpenCVE Recommended Actions

  • Upgrade Junos OS to any release newer than or equal to 23.2R2‑S7.7 and upgrade Junos OS Evolved to any release newer than or equal to 23.2R2‑S7.7‑EVO
  • If a patch cannot be applied immediately, disable MSDP or PIM protocols that use AS‑path expansion or restrict them to trusted neighbors only
  • Validate configuration changes to ensure no unintended null pointer references may be introduced during future updates

Generated by OpenCVE AI on October 15, 2026 at 16:13 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 17 Oct 2026 00:00:00 +0000

Type Values Removed Values Added
First Time appeared Juniper Networks
Juniper Networks junos Os
Juniper Networks junos Os Evolved
Vendors & Products Juniper Networks
Juniper Networks junos Os
Juniper Networks junos Os Evolved

Fri, 16 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 14 Oct 2026 17:00:00 +0000

Type Values Removed Values Added
Description A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated configured MSDP peer or adjacent PIM sender to cause a denial of service via an MSDP or PIM policy that uses AS-path expansion.
Title Junos OS and Junos OS Evolved: An attacker causes routing-daemon denial of service when an MSDP or PIM policy uses AS-path expansion
Weaknesses CWE-476
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M'}

Subscriptions

Juniper Networks Junos Os Junos Os Evolved
cve-icon MITRE

Status: PUBLISHED

Assigner: juniper

Published:

Updated: 2026-10-16T16:39:06.156Z

Reserved: 2026-09-28T17:33:49.411Z

Link: CVE-2026-102029

cve-icon Vulnrichment

Updated: 2026-10-16T16:39:00.960Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-14T17:17:56.303

Modified: 2026-10-16T17:17:08.140

Link: CVE-2026-102029

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-16T23:45:13Z

Weaknesses