CVE-2026-101939: CWE-476 NULL Pointer Dereference in Juniper Networks Junos OS

This vulnerability involves a NULL Pointer Dereference in Juniper Networks Junos OS and Junos OS Evolved's routing protocol daemon (RPD). When an import policy uses 'then source-based-forwarding next-hop next-table <X>' to reference a routing table that does not exist, a BGP UPDATE from a configured peer can cause the RPD to crash, resulting in a denial of service. The issue affects multiple versions across several release trains, including both standard and evolved versions. The CVSS 3.1 base score is 7.5, indicating high severity due to network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability (denial of service). There is no information provided about available patches or vendor advisories.

Successful exploitation causes a denial of service by crashing the routing protocol daemon (RPD), disrupting routing operations on affected Junos OS and Junos OS Evolved devices. There is no impact on confidentiality or integrity reported. The attack can be performed remotely without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid configuring import policies that reference non-existent routing tables with 'then source-based-forwarding next-hop next-table <X>'. Monitor Juniper Networks advisories for updates and apply official patches once released.