CVE-2026-21909
BaseFortify
Publication date: 2026-01-15
Last updated on: 2026-01-15
Assigner: Juniper Networks, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| juniper | junios | From 23.2 (inc) to 23.2R2 (exc) |
| juniper | junios | From 23.4 (inc) to 23.4R1-S2 (exc) |
| juniper | junios | From 24.1 (inc) to 24.1R2 (exc) |
| juniper | junios_evolved | From 23.2 (inc) to 23.2R2-EVO (exc) |
| juniper | junios_evolved | From 23.4 (inc) to 23.4R1-S2-EVO (exc) |
| juniper | junios_evolved | From 24.1 (inc) to 24.1R2-EVO (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-401 | The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Missing Release of Memory after Effective Lifetime issue in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. An unauthenticated attacker who controls an adjacent IS-IS neighbor can send a specific update packet that causes a memory leak. Continued receipt and processing of these packets exhausts all available memory, causing the rpd process to crash and resulting in a Denial of Service (DoS) condition.
How can this vulnerability impact me? :
The impact of this vulnerability is a Denial of Service (DoS) condition. An attacker can cause the routing protocol daemon (rpd) to crash by exhausting all available memory through specially crafted packets, which can disrupt network routing and availability.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring memory usage on the affected Junos OS or Junos OS Evolved devices. You can use the command 'show task memory detail | match ted-infra' to check for abnormal memory consumption related to the TED-INFRA-COOKIE task, which indicates the memory leak caused by the vulnerability.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include upgrading the Junos OS or Junos OS Evolved software to a fixed version that addresses this vulnerability. Specifically, upgrade to versions 23.2R2 or later for 23.2 releases, 23.4R1-S2 or 23.4R2 or later for 23.4 releases, and 24.1R2 or later for 24.1 releases. Until the upgrade can be applied, monitoring memory usage closely and limiting or controlling IS-IS neighbor adjacencies from untrusted sources may help reduce risk.