CVE-2026-101970 in Junos OS
Summary
by MITRE • 10/14/2026
A Use After Free vulnerability in the rpd PIM Join/Prune processing of Juniper Networks Junos OS and Junos OS Evolved platforms allows an unauthenticated adjacent attacker to crash the routing daemon via specific PIM messages when sparse mode PIM is configured.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/14/2026
The identified security flaw represents a critical Use After Free vulnerability located within the Protocol Independent Multicast (PIM) Join/Prune message processing logic of the Routing Process Daemon, commonly referred to as rpd, in Juniper Networks Junos OS and Junos OS Evolved platforms. This specific class of memory corruption error occurs when the software fails to properly manage the lifecycle of dynamically allocated memory structures associated with PIM state information. Specifically, during the handling of incoming PIM Join or Prune messages under sparse mode configurations, a race condition or logic error allows the system to access and dereference a pointer that has already been freed by another part of the process. This architectural failure in memory management is particularly dangerous because it does not require any form of authentication from the attacker, relying instead on the network adjacency required for PIM neighbor discovery protocols to function correctly.
From an operational perspective, this vulnerability poses a severe risk to the stability and availability of routing infrastructure. An unauthenticated adjacent attacker can exploit this flaw by crafting and sending specific malformed or carefully timed PIM Join/Prune messages to the affected device. The successful exploitation results in immediate memory corruption within the rpd process, leading directly to a crash of the routing daemon. Since rpd is responsible for maintaining critical routing protocols such as OSPF, BGP, IS-IS, and static routes, its termination causes an abrupt loss of control plane functionality on the router. This effectively severs all dynamic routing adjacencies managed by that instance, causing significant network disruption including potential blackholing of traffic, loss of connectivity to upstream providers, and instability in service delivery for downstream networks relying on the compromised device as a transit or edge node.
The technical classification of this vulnerability aligns with CWE-416, Use After Free, which describes situations where a program continues to use a pointer after it has been freed, leading to undefined behavior that can range from crashes to arbitrary code execution depending on memory layout and exploitation techniques. In the context of network devices, while immediate remote code execution may be complex due to modern mitigations like ASLR and DEP, denial of service via process crash is a highly reliable outcome. Furthermore, this vulnerability maps to MITRE ATT&CK technique T1498.002, Network Denial of Service: Reflection Amplification, as the attacker leverages standard routing protocol messages in an adjacent position to disrupt network services. The requirement for adjacency means the threat actor must have direct Layer 2 or Layer 3 connectivity to the target interface, limiting the attack surface primarily to internal networks or directly connected peers rather than the public internet, though this still presents a significant risk in enterprise and service provider environments where trust boundaries between adjacent routers may be loosely defined.
Mitigation strategies for this vulnerability focus on both immediate remediation and long-term architectural hardening. The primary defense is the application of vendor-provided software updates or patches that address the memory management logic within rpd, ensuring that pointers are properly nullified after deallocation and that state synchronization mechanisms prevent access to freed resources during message processing. In environments where patching cannot be applied immediately due to maintenance windows or compatibility concerns, network segmentation should be enforced to restrict PIM adjacency formation only to trusted interfaces. Access Control Lists (ACLs) can be deployed on edge routers to filter out malformed PIM messages from untrusted sources, although this requires careful configuration to avoid disrupting legitimate routing traffic. Additionally, enabling logging for rpd crashes and monitoring system stability metrics allows security operations teams to detect exploitation attempts or subsequent instability early, facilitating rapid incident response before widespread network impact occurs.