CVE-2026-101988 in Junos OS
Summary
by MITRE • 10/15/2026
A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via LDP messages received over an operational LDP session.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The identified vulnerability resides within the Label Distribution Protocol daemon, commonly referred to as rpd, which is a critical component in both Juniper Networks Junos OS and Junos OS Evolved operating systems. This software module is responsible for managing label distribution protocols such as LDP, which are essential for establishing multiprotocol label switching paths in network infrastructure. The specific flaw involves a NULL pointer dereception that occurs when the daemon processes certain Label Distribution Protocol messages received over an operational session. Because this vulnerability affects a core routing protocol service, it represents a significant risk to the stability and availability of networks relying on Juniper hardware for traffic forwarding and path computation.
The technical nature of this defect is classified as CWE-476, which denotes a NULL Pointer Dereference. This type of error typically arises when software attempts to access memory at an address that has not been allocated or initialized properly. In the context of LDP message processing, it suggests that under specific conditions involving malformed or unexpected input within the protocol stream, the rpd fails to validate pointers before use. When such a condition is triggered, the operating system terminates the affected process to prevent further memory corruption or security breaches. Since the routing daemon handles fundamental network control plane functions, its termination results in an immediate loss of routing information and label bindings for adjacent peers.
The operational impact of this vulnerability is severe due to the lack of authentication requirements for exploitation. An unauthenticated attacker who has network layer connectivity to a vulnerable device can trigger the denial of service condition simply by sending specific LDP messages over an existing or newly established session. This capability allows any host on the same local network segment, such as within a LAN or VLAN, to disrupt routing services without needing valid credentials. The resulting impact is a complete disruption of label-switched paths and potentially broader routing instability if the daemon fails to restart correctly or loses state information during the crash. This aligns with ATT&CK technique T1498, Network Denial of Service, specifically sub-technique T1498.002 which involves resource exhaustion through protocol abuse.
Mitigation strategies for this vulnerability primarily involve applying vendor-provided software updates that patch the underlying code defect within the rpd module. Organizations should prioritize upgrading to versions where this NULL pointer dereference has been corrected and validated by Juniper Networks engineering teams. In environments where immediate patching is not feasible, network segmentation can be employed to restrict LDP traffic to trusted peers only, although the unauthenticated nature of the exploit means that any adjacent host remains a potential threat vector until the software is updated. Additionally, implementing strict access control lists on interfaces running LDP can help limit exposure by ensuring that only authorized routers are permitted to establish label distribution sessions with vulnerable devices.