CVE-2026-102028 in Junos OS
Summary
by MITRE • 10/15/2026
A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote BGP peer to cause a denial of service when multiple UPDATEs occur over a single TCP session with 'bgp family l2vpn auto-discovery-only' configured.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified involves a critical NULL pointer dereception within the routing protocol daemon, known as rpd, which is a core component of Juniper Networks Junos OS and Junos OS Evolved operating systems. This specific flaw arises under precise configuration conditions where the Border Gateway Protocol (BGP) family for Layer 2 Virtual Private Network auto-discovery is set to auto-discovery-only mode. In this state, the daemon processes incoming BGP UPDATE messages with insufficient validation of internal data structures before attempting to access them. When a remote peer sends multiple UPDATEs over a single TCP session, the rpd fails to properly initialize or verify certain pointers associated with these updates. Consequently, when the software attempts to dereference these uninitialized or null pointers during processing, it triggers an exception that causes the routing protocol daemon to crash. This results in an immediate denial of service condition for BGP sessions and potentially affects broader network stability depending on the role of the affected device within the infrastructure.
From a technical perspective, this issue is classified under CWE-476, which denotes NULL Pointer Dereference. Such vulnerabilities typically occur when software assumes that a pointer will always point to valid memory but fails to check for null values before use. In the context of BGP processing, the rpd likely expects specific attributes or path information from the UPDATE messages to be present and correctly formatted. When these expectations are not met due to malformed or unexpected data patterns in rapid succession, the internal logic attempts to access a memory address that is zeroed out or invalid. This leads to an segmentation fault or similar fatal error within the user-space daemon process. The attack vector requires only network-level connectivity to port 179, where BGP operates, and does not require authentication if open peering policies are in place, making it accessible to any remote actor with IP reachability to the target device.
The operational impact of this vulnerability is significant for service providers and enterprise networks relying on Juniper infrastructure for routing stability. A successful exploitation allows an unauthenticated attacker to remotely crash the BGP process by sending a carefully crafted sequence of UPDATE messages. Since rpd handles critical routing functions, its failure can lead to the loss of all BGP sessions managed by that instance, causing route flapping or complete blackholing of traffic destined through the affected router. This denial of service disrupts network connectivity and requires manual intervention or automatic restart mechanisms to restore normal operations. In high-availability environments where failover is not instantaneous or properly configured for rpd failures, this can result in extended outages affecting multiple customers or services dependent on the compromised routing infrastructure.
Mitigation strategies primarily involve applying vendor-provided software patches that address the memory handling logic within the BGP processing engine. Administrators should ensure their Junos OS and Junos OS Evolved installations are updated to versions where this NULL pointer dereference has been corrected with proper null checks before accessing pointers derived from incoming UPDATE messages. Additionally, network segmentation and access control lists can be employed to restrict BGP peering relationships only to trusted peers, reducing the attack surface available to potential adversaries. Monitoring for unusual patterns of BGP traffic or frequent rpd restarts may also aid in early detection of exploitation attempts. This vulnerability aligns with ATT&CK technique T1498, Network Denial of Service, as it involves disrupting network availability through resource exhaustion via process crash rather than bandwidth saturation.