CVE-2026-102040 in Junos OS
Summary
by MITRE • 10/14/2026
A NULL Pointer Dereference vulnerability in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to crash the routing daemon and cause a denial of service via an RSVP Path message.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The identified security flaw resides within the Resource Reservation Protocol (RSVP) implementation of the Routing Policy Daemon, commonly referred to as rpd, in Juniper Networks Junos OS and Junos OS Evolved environments. This vulnerability is classified under CWE-476, which denotes a NULL Pointer Dereference condition. The core technical issue arises when the daemon processes specific RSVP Path messages that contain malformed or unexpected data structures. Under normal operational conditions, the software expects valid pointers to memory locations containing protocol state information. However, due to insufficient input validation and error handling logic within the message parsing routine, certain crafted inputs cause the application to attempt accessing a memory address represented by a null value rather than a valid pointer. This logical failure triggers an immediate segmentation fault or similar critical exception within the user-space process of rpd.
From an operational perspective, the impact of this vulnerability is severe regarding service availability. Because the Routing Policy Daemon is responsible for managing routing policies and influencing path selection decisions across the network infrastructure, its abrupt termination disrupts dynamic routing processes. When rpd crashes due to the NULL pointer dereference, it leads to a denial of service condition where affected routers may lose connectivity or experience significant instability in their routing tables. An adjacent unauthenticated attacker can exploit this flaw by sending specially crafted RSVP Path messages directly to the vulnerable device over the network. The requirement for adjacency implies that the attack must originate from a host on the same local network segment, limiting remote exploitation but still posing a critical risk within trusted internal networks or between peer routers in an autonomous system.
This vulnerability aligns with MITRE ATT&CK technique T1498, specifically Network Denial of Service via resource exhaustion or service disruption through protocol abuse. The attacker leverages the robustness requirements of routing protocols to trigger a crash without needing authentication credentials, exploiting the trust relationship inherent in OSPF and RSVP peerings. The lack of authentication requirement for this specific vector highlights a gap in the initial message validation phase before deeper state machine processing occurs.
Mitigation strategies should prioritize applying vendor-provided software patches that address the input validation logic within the rpd component to ensure null pointers are properly checked before dereferencing. In environments where immediate patching is not feasible, network segmentation can be employed to restrict RSVP traffic from untrusted sources or adjacent hosts that do not require routing protocol adjacency with vulnerable devices. Additionally, implementing strict access control lists on interfaces participating in RSVP sessions can help filter out malformed packets and reduce the attack surface available to potential adversaries seeking to disrupt critical routing infrastructure stability.