CVE-2026-102021

Awaiting Analysis Awaiting Analysis - Queue

NULL Pointer Dereference in Juniper Junos OS and Junos OS Evolved RPD

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: Juniper Networks, Inc.

Description

A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent network attacker to cause a denial of service via a crafted RSVP packet when MPLS-TE RSVP processing is enabled. The condition can terminate rpd and disrupt routing protocol sessions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-102021

EUVD

EUVD-2026-101346

Affected Vendors & Products

Vendor	Product	Version / Range
Juniper	Networks	Junos OS 24.4
Juniper	Networks	Junos OS 25.2
Juniper	Networks	Junos OS 25.4
Juniper	Networks	Junos OS 26.2
Juniper	Networks	Junos OS Evolved 24.4
Juniper	Networks	Junos OS Evolved 25.2
Juniper	Networks	Junos OS Evolved 25.4
Juniper	Networks	Junos OS Evolved 26.2
Juniper	Networks	Junos OS Evolved 25.2X100
Juniper	Networks	Junos OS Evolved 25.4X300

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

This is a NULL Pointer Dereference vulnerability in Juniper Networks Junos OS and Junos OS Evolved. It occurs in the routing protocol daemon (rpd) when processing crafted RSVP packets with MPLS-TE RSVP enabled. This causes rpd to terminate, disrupting routing protocol sessions and leading to a denial of service.

Detection Guidance

Detecting this vulnerability requires monitoring for RSVP packet processing issues in Junos OS or Junos OS Evolved. Check for rpd crashes or routing protocol session disruptions. Enable detailed logging for RSVP and MPLS-TE events. Use 'show system processes extensive | match rpd' to monitor rpd status and 'show log messages | match RSVP' to review RSVP-related logs.

Impact Analysis

An adjacent network attacker could exploit this to crash the routing protocol daemon, causing network disruptions. This may lead to loss of connectivity, routing instability, or service outages for affected systems using Junos OS or Junos OS Evolved with MPLS-TE RSVP processing enabled.

Compliance Impact

This vulnerability causes a denial of service by crashing the routing protocol daemon, disrupting routing sessions. While it does not directly impact data confidentiality or integrity, prolonged outages could affect system availability, which may impact compliance with standards requiring high availability like HIPAA for healthcare systems or GDPR for data processing timelines.

Mitigation Strategies

Disable MPLS-TE RSVP processing on affected Juniper devices if not required. Apply Junos OS patches from Juniper Networks as soon as available. Monitor routing protocol sessions for unexpected terminations.

Hi! I’m here to help you understand CVE-2026-102021. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70