CVE-2026-101961
Awaiting Analysis Awaiting Analysis - Queue

NULL Pointer Dereference in Juniper Networks Junos OS and Junos OS Evolved

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: Juniper Networks, Inc.

Description
A NULL Pointer Dereference vulnerability in the routing-policy nexthop-ECMP matcher of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP peer to cause a routing-daemon denial of service via a specific BGP packet received while a nexthop-ecmp qualifier is attached to a BGP import policy.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-14
Last Modified
2026-10-14
Generated
2026-10-19
AI Q&A
2026-10-15
EPSS Evaluated
2026-10-18
NVD
CVE-2026-101961
EUVD
EUVD-2026-101312

Affected Vendors & Products

Showing 15 associated CPEs
Vendor Product Version / Range
Juniper Networks Junos OS 23.4
Juniper Networks Junos OS 24.2
Juniper Networks Junos OS 24.4
Juniper Networks Junos OS 25.2
Juniper Networks Junos OS 25.4
Juniper Networks Junos OS 26.2
Juniper Networks Junos OS Evolved 23.4
Juniper Networks Junos OS Evolved 24.2
Juniper Networks Junos OS Evolved 24.4
Juniper Networks Junos OS Evolved 25.2
Juniper Networks Junos OS Evolved 25.4
Juniper Networks Junos OS Evolved 26.2
Juniper Networks Junos OS Evolved 23.4X100
Juniper Networks Junos OS Evolved 25.2X100
Juniper Networks Junos OS Evolved 25.4X300

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a NULL Pointer Dereference in Juniper Networks Junos OS and Junos OS Evolved. It occurs in the routing-policy nexthop-ECMP matcher when a configured eBGP peer sends a specific BGP packet while a nexthop-ecmp qualifier is attached to a BGP import policy. This can cause the routing daemon to crash, leading to a denial of service.

Detection Guidance

This vulnerability can be detected by monitoring for routing daemon crashes or unexpected behavior in Junos OS or Junos OS Evolved systems configured with BGP import policies using nexthop-ecmp qualifiers. Check system logs for routing daemon crashes or core dumps after receiving BGP packets from eBGP peers.

Impact Analysis

If exploited, this vulnerability could allow an attacker to crash the routing daemon on affected Juniper devices. This would disrupt network routing, causing service outages and potential loss of connectivity for users and systems relying on the device.

Compliance Impact

This vulnerability causes a routing-daemon denial of service via a specific BGP packet, which could disrupt network services. Disruptions may impact data availability, potentially violating compliance requirements for standards like GDPR (data availability) or HIPAA (system reliability).

Mitigation Strategies

Apply the latest Junos OS or Junos OS Evolved patches from Juniper Networks to address the NULL Pointer Dereference vulnerability in the routing-policy nexthop-ECMP matcher. Disable BGP import policies with nexthop-ecmp qualifiers if not required until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-101961. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart