CVE-2026-101939 in Junos OS
Summary
by MITRE • 10/14/2026
A NULL Pointer Dereference vulnerability in the routing protocol daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows a configured peer sending a BGP UPDATE to cause a denial of service when an import policy with `then source-based-forwarding next-hop next-table <X>` is configured to reference a routing table that does not exist.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in the Juniper Networks Junos OS and Junos OS Evolved platforms represents a critical flaw within the Routing Protocol Daemon, specifically affecting the Border Gateway Protocol implementation. This issue manifests as a NULL pointer dereference when the system processes BGP UPDATE messages under specific configuration conditions. The root cause lies in how the routing engine handles import policies that utilize source-based forwarding next-hop resolution directed toward non-existent routing tables. When an administrator configures an import policy with the directive then source-based-forwarding next-hop next-table <X>, where X refers to a routing table identifier that has not been created or is otherwise unavailable within the system, the software fails to perform adequate validation checks before attempting to access memory associated with that target table.
From a technical perspective, this flaw allows an authenticated BGP peer to trigger a denial of service condition by sending specially crafted UPDATE messages. The daemon attempts to resolve the next-hop information based on the specified non-existent routing table. Because the underlying data structure for the referenced table is null or uninitialized due to its absence, the pointer dereference operation fails catastrophically. This memory access violation causes the Routing Protocol Daemon to crash and subsequently restart. While this does not typically allow remote code execution or direct privilege escalation, it results in a significant disruption of routing services on the affected device. The continuous receipt of such packets can lead to repeated daemon crashes, effectively rendering the router unable to maintain stable BGP sessions and forward traffic correctly until manual intervention occurs.
The operational impact of this vulnerability is primarily centered around service availability rather than data confidentiality or integrity. Network administrators relying on Junos OS for critical infrastructure may experience intermittent routing instability if such malformed updates are received from configured peers. In high-availability environments, the restart of the RPD process can cause temporary loss of control plane connectivity and potential packet drops during the convergence period following a crash. This aligns with common failure modes observed in network operating systems where robustness against misconfigured policies or malicious inputs is not sufficiently enforced at the application layer within critical daemons.
This vulnerability maps to CWE-476, which describes NULL Pointer Dereference vulnerabilities that occur when software dereferences a pointer that it expects to be valid but is actually null. In terms of offensive security frameworks, this behavior corresponds to ATT&CK technique T1498, Network Denial of Service, specifically the sub-category of Resource Exhaustion through application crashes or loops induced by specific inputs. The attack vector requires network access and authentication as a BGP peer, meaning it is not exploitable over the internet without prior compromise of credentials or configuration exposure that reveals valid peering relationships.
Mitigation strategies should focus on both immediate remediation and long-term hardening. Juniper Networks has released software updates to address this issue in affected versions of Junos OS and Junos OS Evolved, so applying the latest security patches is the primary defense mechanism. Administrators must ensure that all import policies referencing source-based forwarding next-hop tables are validated against existing routing table configurations before deployment. Implementing strict configuration management practices can prevent such invalid references from entering production environments. Additionally, deploying network access control lists or firewall rules to filter BGP traffic from untrusted peers reduces the attack surface by preventing unauthorized entities from sending crafted UPDATE messages that could trigger this flaw. Regular auditing of routing policies and ensuring redundancy in critical services further mitigates the risk associated with potential daemon crashes caused by such vulnerabilities.