CVE-2026-102021 in Junos OS
Summary
by MITRE • 10/14/2026
A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent network attacker to cause a denial of service via a crafted RSVP packet when MPLS-TE RSVP processing is enabled. The condition can terminate rpd and disrupt routing protocol sessions.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified involves a critical NULL pointer dereception within the routing protocol daemon, known as rpd, which serves as a core component of Juniper Networks' Junos OS and Junos OS Evolved operating systems. This specific flaw is triggered during the processing of Resource Reservation Protocol (RSVP) packets when Multiprotocol Label Switching Traffic Engineering MPLS-TE RSVP functionality is enabled on the device. The nature of this vulnerability classifies it under CWE-476, which denotes a NULL Pointer Dereference, indicating that the software attempts to access memory at an address that has not been allocated or initialized properly. This type of error typically arises when a function returns a null value but the calling code fails to check for this condition before proceeding with operations on the pointer, leading to undefined behavior within the application runtime environment.
From an operational perspective, the exploitation of this vulnerability requires the attacker to be in close proximity to the target network infrastructure, specifically as an adjacent network entity capable of injecting crafted RSVP packets into the communication stream between routers or label switches. By sending a specially constructed packet that triggers the flawed code path within rpd, the attacker can cause the daemon process to crash abruptly. Since rpd is responsible for maintaining routing protocol sessions and computing optimal paths through the network topology, its termination results in an immediate loss of control plane functionality on the affected device. This disruption prevents the router from exchanging routing updates with its neighbors, effectively severing connectivity along specific paths or potentially causing a broader outage depending on the role of the compromised node within the network architecture.
The impact extends beyond simple service interruption to include potential instability in dynamic routing protocols such as OSPF IS-IS BGP which rely on rpd for session management and route calculation. When the daemon terminates unexpectedly, existing sessions are dropped, leading to flapping routes and increased CPU utilization as neighboring devices attempt to re-establish connections. This state of flux can degrade overall network performance and reliability, creating a window of opportunity for further attacks or causing significant business disruption due to loss of connectivity. The requirement for an adjacent attacker limits the scope primarily to internal threats or scenarios where an adversary has gained access to the local subnet but does not require remote exploitation over the public internet, aligning with ATT&CK technique T1498 Network Denial of Service which focuses on impairing availability through resource exhaustion or service disruption.
Mitigation strategies for this vulnerability prioritize applying vendor-supplied software updates that address the underlying code defect by implementing proper null checks and error handling within the RSVP processing logic. Administrators should ensure that all Junos OS and Junos OS Evolved installations are updated to versions where this issue has been resolved according to official security advisories issued by Juniper Networks. In environments where immediate patching is not feasible, network segmentation can be employed to restrict access to routing protocol ports from untrusted or potentially compromised adjacent networks. Additionally disabling MPLS-TE RSVP processing on interfaces that do not require it reduces the attack surface by removing the specific code path vulnerable to exploitation. Continuous monitoring of system logs for unexpected rpd restarts and implementing strict ingress filtering rules can also help in detecting attempts to exploit this flaw before they result in a successful denial of service event.