CVE-2026-101959 in Junos OS
Summary
by MITRE • 10/14/2026
A Function Call With Incorrect Variable or Reference as Argument vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause an rpd crash via specifically malformed LSP-ping.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The identified vulnerability resides within the routing protocol daemon, commonly referred to as rpd, which is a core component of the Juniper Networks Junos Operating System and Junos OS Evolved platforms. This specific flaw is classified under CWE-824, which denotes access to a variable or reference with an incorrect type or argument, leading to undefined behavior within the software execution environment. The root cause involves improper handling of function calls where arguments passed do not match the expected data types or memory structures anticipated by the internal logic. This misalignment typically occurs during the processing of control plane messages, specifically those related to Label Switched Path (LSP) ping operations, which are essential for troubleshooting and verifying connectivity in Multiprotocol Label Switching networks.
An unauthenticated attacker positioned as an adjacent node on the network can exploit this vulnerability by crafting a specially malformed LSP-ping packet. Because the routing protocol daemon processes these packets to maintain network topology and path integrity, it must parse incoming control plane messages without requiring prior authentication for certain operational commands or diagnostic tools. When the rpd receives the maliciously crafted payload, it attempts to process the data using functions that expect valid structures. Due to the incorrect variable reference passed as an argument, the daemon encounters a critical error during execution. This mismatch triggers a segmentation fault or similar memory corruption event, resulting in an immediate crash of the routing protocol daemon service on the targeted device.
The operational impact of this vulnerability is severe due to its potential for denial-of-service attacks against network infrastructure. Since rpd is responsible for maintaining dynamic routing tables and managing label switching paths, its failure disrupts the control plane functionality of the router or switch. This disruption can lead to a loss of connectivity for traffic traversing the affected device, as routes may be withdrawn or become unreachable until the service restarts. In high-availability environments where rapid convergence is critical, such an event could cause temporary blackholing of traffic or trigger unnecessary failover mechanisms, degrading overall network performance and reliability. Furthermore, because the attack requires no authentication, it can be executed by any host with direct Layer 2 adjacency to the vulnerable device, significantly expanding the potential attack surface within a local network segment.
Mitigation strategies for this vulnerability primarily involve applying vendor-provided software patches that correct the argument handling logic within the rpd component. Administrators should ensure their Junos OS and Junos OS Evolved installations are updated to versions where this flaw has been remediated. In scenarios where immediate patching is not feasible, network segmentation controls can be employed to restrict access to routing protocol daemons from untrusted adjacent hosts. Implementing strict ingress filtering on interfaces that receive LSP-ping traffic or disabling unnecessary diagnostic features accessible via control plane messages can reduce the risk of exploitation. Additionally, monitoring for unusual spikes in ICMP echo requests directed at router management addresses may help detect attempted exploitation activities early.
From a threat intelligence perspective, this vulnerability aligns with ATT&CK technique T1498, Network Denial of Service, specifically regarding resource exhaustion through service disruption. The attack vector leverages the inherent trust placed in adjacent network nodes for routing protocol operations, highlighting the importance of securing control plane interfaces against unauthorized access. Security teams should prioritize patching devices running vulnerable versions of Junos OS to prevent potential disruptions to critical network services. Regular audits of configuration settings related to LSP diagnostics and strict adherence to least-privilege principles for interface access are recommended best practices to mitigate similar risks in future deployments.