CVE-2026-102039 in Junos OS
Summary
by MITRE • 10/14/2026
A NULL Pointer Dereference vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause a denial of service via a malformed RSVP Path message received on an EVPL LMP control channel.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The identified security flaw resides within the Resource Reservation Protocol (RSVP) implementation in the routing process daemon, known as rpd, of Juniper Networks Junos OS and Junos OS Evolved platforms. This vulnerability is classified as a NULL Pointer Dereference, which corresponds to CWE-476 in the Common Weakness Enumeration database. The root cause lies in insufficient input validation when processing RSVP Path messages specifically received on an Ethernet Virtual Private Line (EVPL) Label Management Protocol (LMP) control channel. When the rpd process receives a malformed RSVP message that triggers this specific code path, it attempts to access memory at a NULL address rather than handling the error condition gracefully or rejecting the invalid input. This failure in boundary checking and state management leads directly to an application crash within the critical routing daemon.
From an operational perspective, because the rpd process is responsible for maintaining routing tables and managing dynamic routing protocols such as RSVP-TE (Traffic Engineering), its termination results in a significant disruption of network services. An adjacent attacker, who has direct connectivity to the affected device on the same broadcast domain or subnet, can exploit this flaw by crafting and sending specific malformed RSVP Path messages. The immediate consequence is a denial of service condition where the routing process restarts, causing temporary loss of reachability for traffic traversing the MPLS network segments managed by that instance. In environments relying heavily on RSVP-TE for label switched path establishment or in high-availability configurations where rpd crashes can trigger failover events, this vulnerability may lead to prolonged outages, packet loss, and potential instability across the broader network infrastructure dependent on stable routing protocol adjacencies.
This attack vector aligns with MITRE ATT&CK technique T1498, Network Denial of Service, specifically under sub-techniques involving resource exhaustion or service disruption through application layer attacks. The requirement for an adjacent attacker limits the scope to local network threats rather than remote exploitation over the internet, but it remains a critical risk in trusted internal networks where attackers may have gained foothold via other means such as phishing or compromised endpoints on the same VLAN.
Mitigation strategies should prioritize applying vendor-supplied patches that address the input validation logic within the RSVP message parsing routines for EVPL LMP control channels. Administrators must ensure their Junos OS and Junos Evolved installations are updated to versions where this NULL pointer dereference has been remediated. In cases where immediate patching is not feasible, network segmentation should be enforced to restrict access to the management interfaces or specific control plane protocols from untrusted adjacent networks. Additionally, implementing ingress filtering on border routers can help drop malformed RSVP packets before they reach vulnerable devices, although deep packet inspection capabilities may be required for effective mitigation against sophisticated crafted payloads designed to bypass standard header validation checks.