A NULL Pointer Dereference flaw resides in the routing daemon (rpd) of Juniper Networks’ Junos OS and Junos OS Evolved. An adjacent router can send an RSVP Path message without authentication, which triggers the pointer dereference and crashes the daemon. The failure causes the routing plane to stop, resulting in loss of network connectivity for all traffic that relies on that device. The weakness is a classic CWE‑476 null pointer dereference.

Juniper Networks Junos OS and Junos OS Evolved are affected. The flaw exists in Junos OS releases 23.2R2‑S7.7, 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1, and all newer releases. For Junos OS Evolved, the affected releases include 23.2R2‑S7.7‑EVO, 23.4R2‑S8.11‑EVO, 24.2R2‑S5.6‑EVO, 24.4R2‑S5‑EVO, 25.2R2‑S2‑EVO, 25.2X100‑D35‑EVO, 25.4R1‑S3‑EVO, 25.4R2‑EVO, 25.4X300‑D40‑EVO, 26.2R1‑S2‑EVO, 26.2R2‑EVO, 26.4R1‑EVO, and all subsequent releases.

The CVSS base score of 7.1 places this issue in the high‑risk category, and the EPSS score is not available, so the statistical likelihood of exploitation is uncertain. Because the vulnerability is accessed from an adjacent interface with no authentication, an attacker could trigger the crash deterministically once the conditions are met. The flaw is not listed in the CISA KEV catalogue, implying no publicly known exploits yet, but the criticality of routing services means the potential impact on availability is significant. Patching or mitigation is strongly recommended to prevent accidental crashes or intentional Denial of Service attacks.