CVE-2026-101975 in Junos OS
Summary
by MITRE • 10/14/2026
A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent OSPF peer to cause a denial of service via OSPF traffic processed while OSPF Source Packet Routing best-route Prefix-SID installation is configured.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability identified as CVE-2024-3681 represents a critical security flaw within the routing protocol daemon, known as rpd, which serves as the core component for managing dynamic routing protocols in Juniper Networks Junos OS and Junos OS Evolved environments. This specific issue is classified under Common Weakness Enumeration (CWE) category CWE-617, Reachable Assertion, indicating that a programmatic assertion condition can be triggered by external input rather than being unreachable or protected by internal logic checks. The attack vector requires the adversary to have network adjacency with the vulnerable device, meaning they must be directly connected within the same broadcast domain or routed segment where Open Shortest Path First (OSPF) neighbors are established. By crafting and sending specific OSPF traffic packets that exploit inconsistencies in how the routing engine processes Prefix-SID information associated with Source Packet Routing best routes, an attacker can force the rpd process to encounter a state violation that triggers a fatal assertion failure.
From a technical perspective, this vulnerability stems from insufficient validation or boundary checking during the installation of Prefix-SIDs for OSPF best-route paths when Source Packet Routing features are enabled on the device. The routing daemon expects certain structural integrity in the received OSPF Link State Advertisements (LSAs) and associated Segment Routing extensions. When an adjacent peer sends malformed or specifically crafted packets that deviate from expected parameters during this installation phase, the internal logic fails to handle the anomaly gracefully. Instead of logging a warning or dropping the packet silently, the software executes an assertion check designed for debugging purposes in production builds, leading to an immediate termination of the rpd process. This behavior is particularly dangerous because it does not require authentication bypass if OSPF neighbor relationships are already established through standard MD5 or SHA-based authentication mechanisms that may be misconfigured or absent in some deployment scenarios.
The operational impact of this vulnerability is severe and directly results in a Denial of Service (DoS) condition for the affected routing infrastructure. Since rpd handles multiple critical functions beyond just OSPF, including BGP, IS-IS, and general route table management, its crash leads to an immediate loss of dynamic routing capabilities on the device. This causes all routes learned via these protocols to be withdrawn from the forwarding plane, resulting in network partitioning, blackholing of traffic destined for affected subnets, and potential cascading failures across the wider network topology depending on the role of the compromised router. For service providers or enterprise networks relying on high availability and rapid convergence, this disruption can lead to significant downtime and loss of connectivity until the routing daemon is manually restarted by a system administrator or an automated recovery script triggers a reload.
Mitigation strategies for this vulnerability primarily involve applying vendor-provided software patches that address the assertion logic within the rpd component. Organizations running Junos OS or Junos OS Evolved should immediately verify their version against Juniper Networks security advisories and apply the latest recommended updates to close this gap. In environments where patching is not immediately feasible, network segmentation can be employed to restrict OSPF adjacency formation with untrusted peers, ensuring that only authorized routers within a controlled administrative domain can exchange routing information. Additionally, implementing strict access control lists on interfaces participating in OSPF neighbor relationships can help filter out malicious traffic before it reaches the processing engine. Monitoring for unusual spikes in OSPD packet rates or unexpected rpd restarts via syslog monitoring provides an early detection mechanism to identify potential exploitation attempts in real time.
This incident aligns with MITRE ATT&CK technique T1498, Network Denial of Service, specifically under the sub-technique related to exploiting software vulnerabilities for resource exhaustion or service disruption. It also reflects CWE-20, Improper Input Validation, as the root cause lies in the failure to properly validate incoming OSPF packet structures before processing them into internal data structures. Security teams should treat this with high priority due to its remote exploitability over adjacent networks and its direct impact on core network stability. Regular audits of routing protocol configurations, ensuring that only necessary features like Source Packet Routing are enabled if required, can reduce the attack surface. Furthermore, deploying intrusion detection systems capable of identifying anomalous OSPF packet patterns adds a layer of defense-in-depth to protect critical infrastructure against such assertion-based denial-of-service attacks.