CVE-2026-102071 in Junos OS
Summary
by MITRE • 10/15/2026
A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via a specific RSVP packet.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The identified vulnerability represents a critical security flaw within the Routing Protocol Daemon, known as rpd, which is a core component of both Juniper Networks Junos Operating System and Junos OS Evolved. This daemon is responsible for managing dynamic routing protocols, including Resource Reservation Protocol (RSVP), which facilitates traffic engineering and quality of service by reserving resources across network paths. The specific nature of this flaw is classified as a reachable assertion error, indicating that the software fails to properly validate input data before processing it through internal logic checks designed to catch programming errors or unexpected states. When an attacker sends a specifically crafted RSVP packet to the affected device, the rpd process encounters an invalid state during its parsing routine and triggers an assertion failure. Because assertions are typically enabled in production builds for debugging purposes or represent unhandled edge cases that lead to abnormal termination, this condition results in the immediate crash of the routing daemon service rather than a graceful error handling response.
From a technical perspective, the root cause lies in insufficient input validation within the RSVP message processing logic. The attacker does not require authentication nor do they need direct access beyond being an adjacent node on the same network segment where the target device resides. This adjacency requirement means that any host or router connected to the same broadcast domain or switched VLAN can exploit this vulnerability by constructing a malformed RSVP packet containing unexpected fields, incorrect lengths, or invalid protocol versions. Upon receipt of this malicious payload, the rpd process executes code paths that assume certain data structures are well-formed according to RFC standards. When these assumptions are violated by the crafted input, the internal assertion condition evaluates as true in an error context, causing the operating system to terminate the daemon to prevent further corruption or undefined behavior. This mechanism effectively turns a standard routing protocol message into a vector for service disruption.
The operational impact of this vulnerability is severe due to its potential to cause a denial of service against critical network infrastructure. Since rpd manages dynamic routing tables and neighbor adjacencies, crashing this process typically results in the loss of all dynamically learned routes on the affected device. In many Junos configurations, the failure of rpd can trigger broader system instability or require a full reboot of the chassis to restore normal routing operations. This disruption leads to significant network outages, as traffic forwarding relies on accurate routing information maintained by the daemon. For service providers and enterprise networks relying on RSVP for MPLS label switched paths or quality of service guarantees, this vulnerability undermines both availability and reliability. The ability to trigger a crash with an unauthenticated packet makes it particularly dangerous in environments where adjacent devices may include compromised hosts or malicious actors operating within trusted network boundaries.
This incident aligns with Common Weakness Enumeration (CWE) category CWE-617, which describes Reachable Assertion, as well as CWE-20 regarding Improper Input Validation. In the context of the MITRE ATT&CK framework, this vulnerability facilitates Denial of Service via resource exhaustion or service disruption techniques, specifically leveraging protocol-level anomalies to destabilize network infrastructure components. To mitigate this risk, administrators must ensure that Juniper Networks software is updated to versions where the input validation logic in rpd has been hardened against malformed RSVP packets. Additionally, implementing strict access control lists on interfaces facing untrusted networks can prevent adjacent attackers from reaching the vulnerable service. Network segmentation and monitoring for anomalous RSVP traffic patterns provide further layers of defense, ensuring that even if an attacker attempts exploitation, the impact is contained or detected before critical routing services are compromised.