CVE-2026-101949: CWE-476 NULL Pointer Dereference in Juniper Networks Junos OS

This vulnerability (CVE-2026-101949) involves a NULL Pointer Dereference in the routing protocol daemon (rpd) component of Juniper Networks Junos OS and Junos OS Evolved. An unauthenticated remote BGP neighbor can exploit this flaw by sending a VPN-flowspec BGP update that, when readvertised and combined with BMP post-policy RIB-out monitoring, triggers a NULL pointer dereference leading to a denial of service condition. The issue affects a range of Junos OS versions prior to specific fixed releases, including both standard and evolved variants, as well as certain extended versions. The vulnerability has a CVSS v3.1 base score of 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and an impact limited to availability (denial of service). No known exploits in the wild have been reported. The vendor has not provided explicit patch links in the provided data, so patch status should be verified with Juniper advisories.

An unauthenticated remote attacker can cause a denial of service on affected Junos OS devices by exploiting this vulnerability. This results in service disruption due to the routing protocol daemon crashing or becoming unavailable. There is no impact on confidentiality or integrity according to the CVSS vector. The attack requires the attacker to be a BGP neighbor capable of sending VPN-flowspec updates under specific monitoring configurations.

Patch status is not yet confirmed — check the Juniper Networks vendor advisory for current remediation guidance. Until a patch is applied, consider restricting BGP neighbor access to trusted entities and reviewing configurations related to VPN-flowspec updates and BMP post-policy RIB-out monitoring to reduce exposure. Monitor Juniper's official security advisories for updates and patches addressing this vulnerability.