CVE-2026-101941

Awaiting Analysis Awaiting Analysis - Queue

NULL Pointer Dereference in Juniper Junos OS BGP Routing

Publication date: 2026-10-14

Last updated on: 2026-10-18

Assigner: Juniper Networks, Inc.

Description

A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP neighbor to cause a denial of service via a BGP route update when specific routing-policy resolution-map and policy event-tracing configuration is enabled.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-18

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-101941

EUVD

EUVD-2026-101319

Affected Vendors & Products

Vendor	Product	Version / Range
Juniper	Networks	Junos OS 0
Juniper	Networks	Junos OS 23.4
Juniper	Networks	Junos OS 24.2
Juniper	Networks	Junos OS 24.4
Juniper	Networks	Junos OS 25.2
Juniper	Networks	Junos OS 25.4
Juniper	Networks	Junos OS 26.2
Juniper	Networks	Junos OS Evolved 0
Juniper	Networks	Junos OS Evolved 23.4
Juniper	Networks	Junos OS Evolved 24.2
Juniper	Networks	Junos OS Evolved 24.4
Juniper	Networks	Junos OS Evolved 25.2
Juniper	Networks	Junos OS Evolved 25.4
Juniper	Networks	Junos OS Evolved 26.2
Juniper	Networks	Junos OS Evolved 23.4X100
Juniper	Networks	Junos OS Evolved 25.2X100
Juniper	Networks	Junos OS Evolved 25.4X300

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

This vulnerability is a NULL Pointer Dereference flaw in Juniper Networks Junos OS and Junos OS Evolved. It occurs in the routing protocol daemon (rpd) when a configured BGP neighbor sends a malicious route update. The issue requires specific routing-policy resolution-map and policy event-tracing configurations to be enabled.

Detection Guidance

Detection requires checking for specific BGP route updates causing crashes in Junos OS or Junos OS Evolved with routing-policy resolution-map and policy event-tracing enabled. Monitor rpd crashes or logs for NULL pointer dereference errors during BGP updates.

Impact Analysis

A remote attacker could exploit this flaw to cause a denial of service by crashing the rpd process, disrupting network routing and connectivity. Systems with BGP configured and the specific policies enabled are at risk.

Compliance Impact

This vulnerability causes a denial of service via BGP route updates under specific configurations, which could disrupt network availability. Disruptions may impact systems handling sensitive data, potentially violating compliance requirements for availability in standards like GDPR and HIPAA.

Mitigation Strategies

Disable BGP route updates temporarily if specific routing-policy resolution-map and policy event-tracing configurations are enabled. Apply Junos OS or Junos OS Evolved patches from Juniper Networks as soon as available.

Hi! I’m here to help you understand CVE-2026-101941. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70