CVE-2026-101971: CWE-770 Allocation of Resources Without Limits or Throttling in Juniper Networks Junos OS

This vulnerability (CVE-2026-101971) is due to improper resource allocation controls in the routing protocol daemon (rpd) component of Juniper Networks Junos OS and Junos OS Evolved. An unauthenticated attacker adjacent to the network can send crafted OSPFv3 messages on enabled broadcast interfaces to trigger excessive resource allocation, leading to denial of service and heap memory corruption. The issue is classified under CWE-770 (Allocation of Resources Without Limits or Throttling). The CVSS 3.1 base score is 6.5 (medium severity) with attack vector as adjacent network, low attack complexity, no privileges required, no user interaction, and impact limited to availability.

Successful exploitation results in denial of service and heap memory corruption in the routing protocol daemon, potentially disrupting routing functionality on affected Junos OS and Junos OS Evolved devices. There is no impact on confidentiality or integrity reported. The attacker must be adjacent on the network and no authentication is required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Juniper Networks advisories for updates. Until a fix is available, consider limiting exposure of OSPFv3 broadcast interfaces to untrusted adjacent networks to reduce risk.