CVE-2026-101977 in Junos OS
Summary
by MITRE • 10/14/2026
A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP peer to cause a persistent routing-daemon denial of service via a specific BGP packet when ephemeral configuration is used.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The identified security flaw resides within the routing protocol daemon, commonly referred to as rpd, which serves as the core component responsible for managing dynamic routing protocols in Juniper Networks operating systems including both traditional Junos OS and the containerized Junos OS Evolved architecture. This specific vulnerability is classified as a NULL Pointer Dereference, a critical memory safety error that occurs when software attempts to access a memory location at address zero or an invalid null reference without proper validation checks preceding the operation. In the context of network infrastructure, such errors can lead to immediate process crashes, resulting in service disruption and potential system instability depending on how the daemon handles recovery mechanisms.
The attack vector for this vulnerability is particularly concerning because it requires only a configured external Border Gateway Protocol peer to exploit it. An attacker who has established a legitimate BGP session with the vulnerable device can craft and transmit a specifically malformed BGP packet that triggers the null pointer dereference condition within the rpd process. The exploitation of this flaw is contingent upon the use of ephemeral configuration, which refers to temporary or non-persistent routing configurations often used for testing or dynamic network adjustments. This dependency suggests that while the vulnerability exists in the core codebase, its practical exploitability may be limited to scenarios where such transient configurations are actively deployed on the target system.
The operational impact of successfully exploiting this NULL Pointer Dereference is a persistent denial of service against the routing daemon itself. When rpd crashes due to accessing invalid memory, it typically triggers an automatic restart mechanism in Junos environments. However, if the malformed packet continues to be sent or if the crash loop prevents proper initialization of routing tables, the device may experience intermittent loss of connectivity, failure to exchange route updates with peers, or a complete halt in routing functionality until manual intervention occurs. This disruption can lead to significant network outages, as other routers relying on this peer for path information will lose visibility into reachable networks, potentially causing traffic blackholing or suboptimal routing paths across the broader internetwork.
From a classification perspective, this vulnerability aligns with CWE-476, which defines NULL Pointer Dereference as a software error where a program dereferences a pointer that it expects to be valid but is actually null. In terms of adversarial tactics, this exploitation method corresponds to techniques found in the MITRE ATT&CK framework under resource hijacking or impact categories related to service interruption and denial of service. The attacker leverages legitimate protocol interactions to disrupt availability rather than seeking unauthorized access to data or control planes directly through authentication bypasses.
Mitigation strategies for this vulnerability primarily involve applying vendor-provided software patches that address the memory handling logic within rpd to ensure proper validation before pointer dereference operations occur. Administrators should prioritize updating Junos OS and Junos OS Evolved installations to versions where this flaw has been remediated. In environments where immediate patching is not feasible, network segmentation can be employed to restrict BGP peering relationships with untrusted or external peers until the update cycle is complete. Additionally, implementing strict input validation on border routers and monitoring for unusual routing protocol traffic patterns may help detect attempted exploitation activities before they result in daemon crashes.