CVE-2026-101961 in Junos OS
Summary
by MITRE • 10/14/2026
A NULL Pointer Dereference vulnerability in the routing-policy nexthop-ECMP matcher of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP peer to cause a routing-daemon denial of service via a specific BGP packet received while a nexthop-ecmp qualifier is attached to a BGP import policy.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability identified in the routing-policy nexthop-ECMP matcher within Juniper Networks Junos OS and Junos OS Evolved represents a critical flaw in how the operating system processes Border Gateway Protocol packets under specific configuration conditions. This issue is classified as a NULL Pointer Dereference, which corresponds to CWE-476 in the Common Weakness Enumeration standard. The root cause lies in the handling of Equal-Cost Multi-Path routing attributes when they are evaluated against BGP import policies that utilize nexthop-ecmp qualifiers. Under normal operational circumstances, the routing daemon correctly interprets these multi-path indicators and updates the forwarding table accordingly. However, a specific sequence or structure within an incoming BGP packet can trigger a logic error where the system attempts to access memory at a null address rather than validating the integrity of the nexthop data first.
The exploitation vector for this vulnerability requires an attacker to be configured as an external Border Gateway Protocol peer with direct connectivity to the affected device. By sending a specifically crafted BGP packet while a nexthop-ecmp qualifier is active in the local import policy, the malicious actor can induce the routing daemon to crash. This results in a denial of service condition where the primary function of the router, which is route processing and forwarding table maintenance, becomes unavailable. The impact extends beyond simple process restart; depending on the high availability configuration of the network infrastructure, this could lead to temporary loss of connectivity or require manual intervention to restore full routing functionality if automatic failover mechanisms are not properly configured or affected by the same flaw during switchover events.
From a tactical perspective, this vulnerability aligns with MITRE ATT&CK technique T1498 Network Denial of Service, specifically sub-technique 002 which involves flooding to disrupt services. The attacker does not need to execute arbitrary code or gain persistent access; the objective is purely disruptive, aiming to degrade network reliability and availability. This makes it particularly dangerous in critical infrastructure environments where routing stability is paramount for maintaining service continuity across multiple domains or autonomous systems.
Mitigation strategies should focus on both immediate operational controls and long-term remediation steps. The most effective immediate countermeasure involves restricting BGP peering sessions from untrusted sources by implementing strict access control lists that limit which IP addresses can establish eBGP connections with the vulnerable device. Additionally, administrators should review their routing policies to determine if nexthop-ecmp qualifiers are strictly necessary for all import policies; removing unnecessary configurations may reduce the attack surface. It is imperative to apply the vendor-provided software patches as soon as they become available, as these updates address the underlying memory management error in the packet parsing logic. Until patches are applied, continuous monitoring of routing daemon stability and BGP session states can help detect potential exploitation attempts early, allowing for rapid response before a full denial of service occurs.