CVE-2026-101949 in Junos OS
Summary
by MITRE • 10/14/2026
A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated remote BGP neighbor to cause a denial of service via a VPN-flowspec BGP update if it is readvertised and BMP post-policy RIB-out monitoring is configured.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified involves a critical NULL pointer dereception within the routing protocol daemon, known as rpd, which serves as the core component for managing dynamic routing protocols in Juniper Networks Junos OS and Junos OS Evolved environments. This specific flaw manifests when the system processes Border Gateway Protocol (BGP) updates related to VPN-flowspec extensions under a precise combination of configuration conditions. Specifically, the issue is triggered only when BMP post-policy RIB-out monitoring is enabled on the device while simultaneously receiving a maliciously crafted BGP update from an unauthenticated remote neighbor that utilizes VPN-flowspec attributes and involves readvertisement scenarios. The presence of these specific configurations creates a code path where memory management fails to properly validate pointers before access, leading directly to a segmentation fault or process crash within rpd.
From a technical perspective, the root cause lies in improper input validation and error handling during the parsing and processing of BGP VPN-flowspec updates. When an unauthenticated peer sends a specially constructed update packet containing specific flow specification attributes that are subsequently readvertised through internal routing tables, the daemon attempts to reference memory locations associated with these new routes or policy actions. Due to the lack of sufficient checks on pointer validity in this particular execution path, the system encounters a NULL value where an object instance was expected. This results in immediate termination of the rpd process, which is responsible for maintaining the routing table and exchanging route information across network interfaces. The attack does not require authentication credentials, allowing any remote actor with network connectivity to exploit this condition without prior authorization or valid session establishment beyond basic TCP handshake requirements typical for BGP peering.
The operational impact of exploiting this vulnerability is severe, primarily resulting in a denial of service against the affected router. Since rpd is a high-priority system process responsible for routing logic, its crash causes immediate disruption to all active BGP sessions and potentially other dynamic routing protocols running on the device. This leads to loss of connectivity for traffic traversing through the Juniper device, as routes may be withdrawn or become unreachable until the daemon restarts automatically or is manually restarted by network administrators. In high-availability deployments where stateful failover depends on continuous process stability, this crash can trigger unnecessary failovers, causing transient outages and potential data loss during convergence periods. Furthermore, repeated exploitation attempts could lead to resource exhaustion if the system repeatedly crashes and recycles the rpd process, degrading overall device performance and stability over time.
This vulnerability aligns with CWE-476, which defines a NULL Pointer Dereference as a software error where a program dereferences a pointer that it expects to be valid but is actually null, often leading to application crashes or denial of service conditions. In the context of attack frameworks such as MITRE ATT&CK, this exploitation technique falls under T1498 Network Denial of Service, specifically reflecting indirect network disruption via resource exhaustion or process instability rather than direct bandwidth saturation. The unauthenticated nature of the vector places it within remote code execution categories that degrade availability, highlighting risks associated with exposing BGP interfaces to untrusted networks without adequate filtering or authentication mechanisms like MD5/TCP-AO.
Mitigation strategies must focus on both configuration hardening and network-level controls. Administrators should evaluate whether BMP post-policy RIB-out monitoring is strictly necessary for their operational requirements; if not required, disabling this feature removes the vulnerable code path entirely. Where such monitoring is essential, implementing strict access control lists (ACLs) to restrict BGP peering sessions only to trusted, authenticated peers significantly reduces exposure risk. Additionally, deploying route filtering policies that validate and sanitize incoming VPN-flowspec updates before they are processed by rpd can prevent malformed or maliciously crafted packets from triggering the flaw. Keeping Junos OS and Junos OS Evolved updated with vendor-provided patches is critical, as these typically include fixes for such memory safety issues within the routing daemon logic. Network architects should also consider placing BGP peers behind firewalls that inspect protocol payloads to block anomalous update patterns indicative of exploitation attempts.