CVE-2026-102042 in Junos OS
Summary
by MITRE • 10/14/2026
A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to crash the routing process via RSVP-TE associated-bidirectional LSP signaling.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/15/2026
The identified vulnerability represents a critical flaw within the Resource Reservation Protocol-Traffic Engineering (RSVP-TE) implementation of the Routing Process Daemon, or rpd, in Juniper Networks Junos OS and Junos OS Evolved environments. This specific issue is classified as a reachable assertion failure, which occurs when the software encounters an unexpected condition during packet processing that violates internal assumptions made by the developers. In this context, the flaw is triggered specifically through RSVP-TE associated-bidirectional Label Switched Path (LSP) signaling messages. An attacker positioned in an adjacent network position can craft and transmit specially designed packets that exploit these logical inconsistencies within the rpd process. The execution of this attack vector leads directly to a crash or restart of the routing daemon, resulting in a significant disruption to the device's ability to maintain dynamic routing adjacencies and forward traffic correctly.
From a technical perspective, assertion failures are typically defensive programming mechanisms intended to catch bugs during development rather than allow them into production code. However, when such assertions become reachable via external network inputs, they indicate that input validation or state machine logic is insufficiently robust against malformed or edge-case signaling messages. The RSVP-TE protocol is essential for establishing traffic engineering tunnels in MPLS networks, and its complexity introduces numerous states and interactions between different routing protocols. The bidirectional LSP feature adds further complexity by requiring synchronized setup of forward and reverse paths. If the rpd process does not adequately validate all parameters or handle race conditions during this synchronization phase, it may encounter an internal state that triggers a fatal assertion error. This results in the termination of the rpd process, which is responsible for running OSPF, IS-IS, BGP, and other core routing protocols on Juniper platforms.
The operational impact of this vulnerability is severe due to its potential to cause a denial of service against critical network infrastructure. When the rpd process crashes, the device loses its dynamic routing capabilities until the daemon restarts automatically or requires manual intervention. During this outage interval, routes may be withdrawn from neighboring routers, causing traffic blackholing and connectivity loss across the affected segment of the network. Furthermore, if the crash occurs repeatedly due to sustained attack attempts, it can lead to instability in the broader routing domain, potentially triggering route flapping and increased CPU utilization as neighbors attempt to re-establish adjacencies. Because the vulnerability requires only adjacent access, an attacker with local network connectivity or compromised host access within the same broadcast domain can exploit this flaw without needing authentication credentials for the device itself.
This incident aligns closely with CWE-617, which describes a reachable assertion failure that allows denial of service through unexpected termination of processes. Additionally, from the perspective of the MITRE ATT&CK framework, this vulnerability facilitates actions categorized under Denial of Service techniques, specifically those targeting network services or system availability. The attack vector is classified as Adjacent Network Access, indicating that physical or logical proximity to the target device is a prerequisite for exploitation. This highlights the importance of securing internal routing segments and implementing strict access controls on management planes and data plane interfaces where RSVP-TE signaling occurs.
Mitigation strategies should prioritize applying vendor-provided software updates that address this specific assertion failure in the rpd process. Organizations running Junos OS or Junos OS Evolved must verify their current version against the official security advisory released by Juniper Networks to determine if they are affected and apply the corresponding patch immediately. In scenarios where immediate patching is not feasible, network segmentation should be enforced to restrict RSVP-TE peering sessions only to trusted neighboring routers that require them for traffic engineering purposes. Access Control Lists (ACLs) can be deployed on interfaces carrying RSVP-TE traffic to block malformed packets or limit signaling from untrusted sources. Additionally, enabling logging and monitoring tools to detect abnormal patterns in RSVP message exchange rates can help identify potential exploitation attempts early, allowing security teams to respond before a crash occurs. Regular audits of routing configurations ensure that only necessary protocols are enabled on interfaces facing potentially hostile networks, thereby reducing the attack surface available for such signaling-based exploits.