CVE-2026-101941 in Junos OS
Summary
by MITRE • 10/15/2026
A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP neighbor to cause a denial of service via a BGP route update when specific routing-policy resolution-map and policy event-tracing configuration is enabled.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified involves a critical NULL pointer dereception within the routing protocol daemon, known as rpd, which serves as the core component for managing dynamic routing protocols in Juniper Networks Junos OS and Junos OS Evolved environments. This specific flaw is triggered when an attacker who has been configured as a Border Gateway Protocol neighbor sends a specially crafted BGP route update to the affected system. The exploitation of this vulnerability does not require authentication beyond what is already required for establishing a BGP peering session, meaning that any entity with valid credentials or access to establish such a connection can potentially trigger the flaw. The root cause lies in how rpd processes routing policy configurations when specific features are enabled concurrently. Specifically, the interaction between configured resolution maps and active policy event tracing creates an unsafe code path where memory references are not properly validated before being accessed. When the daemon attempts to resolve routes using these complex policies while simultaneously logging events for trace purposes, it may encounter a scenario where expected data structures have not been initialized or have already been freed, leading to a reference of a NULL pointer in memory.
From an operational perspective, this vulnerability results in a severe denial of service condition. Upon the occurrence of the NULL pointer dereference, the routing protocol daemon typically crashes and restarts automatically by default on many Juniper platforms. While automatic restart mechanisms are designed to maintain network stability, the repeated crashing and restarting of rpd can lead to significant instability within the routing infrastructure. During these outages, route advertisements may be withdrawn or delayed, causing transient black holes in traffic flow, increased latency due to reconvergence delays, and potential loss of connectivity for services relying on dynamic BGP routes. In environments where high availability is critical, such as service provider networks or large enterprise backbones, this instability can cascade into broader network disruptions if multiple peers are affected or if the daemon fails to recover gracefully. The impact is strictly limited to denial of service; there is no indication that this vulnerability allows for arbitrary code execution or privilege escalation, but the availability impact alone poses a significant risk to business continuity and operational reliability.
This technical flaw aligns with Common Weakness Enumeration identifier CWE-476, which describes NULL Pointer Dereference vulnerabilities where software fails to check if a pointer value is null before using it. The exploitation vector for this issue corresponds to ATT&CK technique T1498.002, Network Denial of Service: Reflection Amplification, although in this specific context, it is more accurately categorized under direct service disruption via protocol manipulation rather than amplification attacks. The attacker leverages the BGP protocol's inherent trust model and configuration dependencies to trigger internal software errors. To mitigate this risk, network administrators must ensure that their Juniper devices are running firmware versions that include patches for this specific issue. It is crucial to review current configurations for any instances where resolution maps and policy event tracing are enabled simultaneously on interfaces accepting BGP updates from untrusted or semi-trusted peers. If such a configuration cannot be avoided due to operational requirements, implementing strict access control lists (ACLs) to restrict which neighbors can send route updates that trigger the specific policy logic is recommended. Additionally, enabling routing protocol authentication and monitoring for unusual patterns of route withdrawals or daemon restarts can aid in early detection of exploitation attempts while patching efforts are underway.