CVE-2026-101961: CWE-476 NULL Pointer Dereference in Juniper Networks Junos OS

This vulnerability (CVE-2026-101961) involves a NULL Pointer Dereference in the routing-policy nexthop-ECMP matcher component of Juniper Networks Junos OS and Junos OS Evolved. When a configured eBGP peer sends a crafted BGP packet while a nexthop-ecmp qualifier is attached to a BGP import policy, it triggers a NULL pointer dereference that causes the routing daemon to crash, resulting in a denial of service condition. The issue affects multiple specific versions of Junos OS and Junos OS Evolved, as detailed in the affectedVersions list. The CVSS v3.1 base score is 7.5, reflecting a network attack vector with low attack complexity, no privileges required, no user interaction, and an impact limited to availability (denial of service). There are no known exploits in the wild, and no vendor advisory or patch links were provided, so patch status is not confirmed.

Successful exploitation causes a denial of service (DoS) by crashing the routing daemon, which can disrupt network routing on affected devices. There is no confidentiality or integrity impact reported. The vulnerability can be triggered remotely by an unauthenticated attacker with eBGP peer configuration.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, consider restricting or monitoring eBGP peer connections and carefully reviewing routing policies that use the nexthop-ecmp qualifier to reduce exposure. No vendor advisory or official fix information is provided in the input data.