CVE-2026-102041 in Junos OS
Summary
by MITRE • 10/14/2026
A Reachable Assertion vulnerability in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated network attacker to cause a denial of service via malformed RSVP signaling when RSVP is enabled.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The identified security flaw resides within the Resource Reservation Protocol (RSVP) implementation of the Routing Policy Daemon, commonly referred to as rpd, in Juniper Networks Junos OS and Junos OS Evolved environments. This vulnerability is classified as a reachable assertion error, which fundamentally represents an internal software logic failure where the application encounters an unexpected condition that violates its own assumptions about valid input or state. When RSVP signaling is enabled on network interfaces, the daemon processes incoming protocol messages to establish resource reservations for traffic engineering purposes. The specific trigger involves the reception of malformed RSVP packets from a directly connected neighbor. Because the vulnerability affects the rpd process, which handles critical routing and policy decisions, any disruption to this component can have immediate and severe consequences for the stability of the entire network infrastructure managed by that device.
From an operational perspective, the exploitation of this reachable assertion leads to a denial of service condition. When an adjacent unauthenticated attacker sends specifically crafted RSVP messages designed to trigger the faulty code path, the rpd process detects the invalid state and executes its error handling routine for assertions. In many Unix-like operating systems, including those underlying Junos OS, triggering an assertion failure typically results in the immediate termination or core dump of the offending process. Since rpd is a high-priority system daemon responsible for maintaining routing tables and policy configurations, its abrupt restart can cause transient loss of connectivity, route flapping, or temporary unavailability of control plane functions. This effectively denies legitimate network services to users relying on that router for traffic forwarding and path computation, impacting business continuity without requiring any form of authentication from the attacker.
The technical nature of this flaw aligns with CWE-617, which describes Reachable Assertion vulnerabilities where a program contains an assertion statement that can be triggered by external input due to insufficient validation or error handling logic. The root cause lies in the lack of rigorous sanitization and boundary checking for RSVP message fields before they are processed by critical decision-making structures within the daemon. An attacker positioned at Layer 2 adjacency, such as on a shared broadcast segment or through direct physical connection, can exploit this trust assumption to inject malicious signaling data. This scenario is further contextualized by MITRE ATT&CK technique T1498, Network Denial of Service, specifically under sub-techniques involving resource exhaustion or service disruption via protocol abuse. The unauthenticated nature of the attack vector means that no credentials are required, lowering the barrier to entry for potential adversaries and increasing the likelihood of exploitation in environments where adjacent devices may not be fully trusted or monitored closely enough at the network layer.
Mitigation strategies must focus on both immediate remediation and long-term architectural hardening. The primary defense is to apply the vendor-provided software patches that address the assertion logic within the rpd component, ensuring that malformed RSVP packets are handled gracefully without causing process termination. Until patching can be performed, administrators should consider disabling RSVP on interfaces where it is not strictly necessary for traffic engineering operations, thereby removing the attack surface entirely. Additionally, implementing strict access control lists or prefix filtering on adjacent links can prevent unauthorized devices from sending RSVP messages to the router. Network segmentation and monitoring solutions that detect anomalous RSVP packet patterns may also provide early warning indicators of attempted exploitation attempts. Regular audits of routing protocols enabled on edge interfaces are recommended to ensure that only necessary services are exposed to potentially untrusted network segments, thereby reducing the risk profile associated with protocol-level vulnerabilities in critical infrastructure components.