CVE-2026-101941: CWE-476 NULL Pointer Dereference in Juniper Networks Junos OS

This vulnerability (CVE-2026-101941) involves a NULL Pointer Dereference in the routing protocol daemon (rpd) component of Juniper Networks Junos OS and Junos OS Evolved. A remote attacker, who is a configured BGP neighbor, can trigger a denial of service condition by sending a BGP route update when certain routing-policy resolution-map and policy event-tracing configurations are enabled. The flaw causes the rpd process to crash, resulting in service disruption. The vulnerability affects multiple versions across several release trains of Junos OS and Junos OS Evolved, including versions prior to 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 26.2R1-S2 and their corresponding EVO and X100/X300 variants. The CVSS score of 7.5 reflects a high impact on availability with no confidentiality or integrity impact. No public exploit code or active exploitation is known at this time.

Successful exploitation results in a denial of service condition by crashing the routing protocol daemon (rpd), disrupting BGP routing on affected devices. There is no impact on confidentiality or integrity. The attack requires the attacker to be a configured BGP neighbor and specific routing-policy configurations to be enabled.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling the specific routing-policy resolution-map and policy event-tracing configurations if feasible to reduce exposure. Monitor Juniper Networks advisories for updates and patches addressing this vulnerability.