CVE-2026-101948: CWE-476 NULL Pointer Dereference in Juniper Networks Junos OS

This vulnerability (CVE-2026-101948) involves a NULL Pointer Dereference in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. A remote unauthenticated BGP peer can trigger a denial of service by sending a crafted BGP FlowSpec update to an affected BGP session. The flaw impacts several versions of Junos OS and Junos OS Evolved, as specified by the affected version ranges. The vulnerability is classified under CWE-476 (NULL Pointer Dereference) and has a CVSS v3.1 base score of 7.5, indicating high severity. No known exploits in the wild have been reported, and no vendor patch or advisory details are included in the provided data.

The vulnerability allows a remote unauthenticated attacker controlling a BGP peer to cause a denial of service condition on the affected device by triggering a NULL Pointer Dereference in the routing protocol daemon. This results in service disruption but does not impact confidentiality or integrity according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no vendor advisory or patch links are provided, users should monitor Juniper Networks' official security advisories for updates and apply any available patches or mitigations promptly once released.