CVE-2026-101939
Awaiting Analysis Awaiting Analysis - Queue

NULL Pointer Dereference in Juniper Junos OS RPD

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: Juniper Networks, Inc.

Description
A NULL Pointer Dereference vulnerability in the routing protocol daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows a configured peer sending a BGP UPDATE to cause a denial of service when an import policy with `then source-based-forwarding next-hop next-table <X>` is configured to reference a routing table that does not exist.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-14
Last Modified
2026-10-16
Generated
2026-10-19
AI Q&A
2026-10-15
EPSS Evaluated
2026-10-18
NVD
CVE-2026-101939
EUVD
EUVD-2026-101491

Affected Vendors & Products

Showing 17 associated CPEs
Vendor Product Version / Range
Juniper Networks Junos OS 0
Juniper Networks Junos OS 23.4
Juniper Networks Junos OS 24.2
Juniper Networks Junos OS 24.4
Juniper Networks Junos OS 25.2
Juniper Networks Junos OS 25.4
Juniper Networks Junos OS 26.2
Juniper Networks Junos OS Evolved 0
Juniper Networks Junos OS Evolved 23.4
Juniper Networks Junos OS Evolved 24.2
Juniper Networks Junos OS Evolved 24.4
Juniper Networks Junos OS Evolved 25.2
Juniper Networks Junos OS Evolved 25.4
Juniper Networks Junos OS Evolved 26.2
Juniper Networks Junos OS Evolved 23.4X100
Juniper Networks Junos OS Evolved 25.2X100
Juniper Networks Junos OS Evolved 25.4X300

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a NULL Pointer Dereference vulnerability in Juniper Networks Junos OS and Junos OS Evolved. It occurs when a configured BGP peer sends a malicious UPDATE message to a router with an import policy that references a non-existent routing table using 'then source-based-forwarding next-hop next-table <X>'. This causes the routing protocol daemon (RPD) to crash, leading to a denial of service.

Detection Guidance

This vulnerability can be detected by checking for crashes in the routing protocol daemon (RPD) on Juniper Junos OS or Junos OS Evolved systems. Monitor logs for BGP UPDATE messages triggering NULL pointer dereferences. Verify if import policies with 'then source-based-forwarding next-hop next-table <X>' reference non-existent routing tables.

Impact Analysis

This vulnerability can cause your Juniper router to crash and stop processing network traffic, resulting in a denial of service. If exploited, it may disrupt network operations, leading to connectivity issues and potential loss of service for users and systems relying on the affected router.

Compliance Impact

This vulnerability causes a denial of service (DoS) in Juniper Junos OS and Junos OS Evolved when a BGP UPDATE is sent by a configured peer with a specific import policy referencing a non-existent routing table. This could disrupt network availability, potentially violating compliance requirements for uptime and reliability in standards like GDPR (data processing continuity) and HIPAA (healthcare system availability).

Mitigation Strategies

Remove or correct any import policy using 'then source-based-forwarding next-hop next-table <X>' referencing a non-existent routing table. Verify routing table existence and policy configuration.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-101939. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart