CVE-2026-102029 in Junos OS
Summary
by MITRE • 10/15/2026
A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated configured MSDP peer or adjacent PIM sender to cause a denial of service via an MSDP or PIM policy that uses AS-path expansion.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified involves a critical NULL pointer dereception within the routing protocol daemon, known as rpd, which is a core component of Juniper Networks' Junos OS and Junos OS Evolved operating systems. This specific flaw arises from improper handling of memory pointers when processing certain policy configurations related to Autonomous System path expansion. The technical root cause lies in the failure of the software to adequately validate input parameters or ensure that referenced data structures are properly initialized before they are accessed during the execution of routing policies. When an attacker triggers this condition, the application attempts to dereference a pointer that holds no valid memory address, leading directly to a segmentation fault and subsequent crash of the rpd process. This type of error is classified under CWE-476, which denotes NULL Pointer Dereference, indicating a fundamental flaw in input validation and memory management practices within the affected software modules.
The operational impact of this vulnerability is severe, primarily manifesting as a denial of service against the network infrastructure running the compromised operating system. Because the routing protocol daemon is responsible for maintaining dynamic routing tables and exchanging route information with neighboring devices, its crash results in an immediate loss of connectivity and potential blackholing of traffic destined through or originating from the affected device. The vulnerability can be exploited by an unauthenticated configured MSDP peer or an adjacent PIM sender, meaning that any entity established as a legitimate neighbor in these multicast routing protocols can trigger the flaw without needing prior authentication credentials. This significantly lowers the barrier to entry for attackers who have network access to the router's management plane or data plane interfaces associated with these specific protocol peers.
From a tactical perspective, this vulnerability aligns with MITRE ATT&CK technique T1498, Network Denial of Service, specifically under the sub-technique of Resource Exhaustion: Overflow. An attacker can leverage AS-path expansion policies to craft malformed or excessively complex routing updates that trigger the NULL pointer dereference repeatedly or sustainably. The use of AS-path expansion is particularly dangerous because it allows for the manipulation of path attributes in ways that may exceed expected processing limits, thereby exposing the underlying memory management defects. This exploitation vector highlights the risks associated with allowing unauthenticated peers to influence critical routing decisions and policy evaluations within enterprise networks.
Mitigation strategies must focus on both immediate remediation and long-term architectural hardening. The primary defense is to apply the vendor-provided software patches that address this specific NULL pointer dereference issue in the rpd component. Organizations should prioritize updating their Juniper devices running affected versions of Junos OS or Junos OS Evolved as soon as security updates are available. In addition to patching, network segmentation and access control lists should be reviewed to ensure that only trusted and authorized peers can establish MSDP or PIM adjacencies with critical routing infrastructure. Implementing strict filtering policies on inbound route advertisements can also help prevent the delivery of maliciously crafted AS-path expansions that trigger the vulnerability. Furthermore, enabling logging for rpd crashes and monitoring for sudden changes in routing table stability can aid in early detection of exploitation attempts before significant service disruption occurs.