CVE-2026-101988: CWE-476 NULL Pointer Dereference in Juniper Networks Junos OS

This vulnerability (CVE-2026-101988) involves a NULL Pointer Dereference in the routing protocol daemon (rpd) component of Juniper Networks Junos OS and Junos OS Evolved. When an unauthenticated attacker adjacent to the device sends crafted LDP (Label Distribution Protocol) messages over an active LDP session, it can trigger a NULL pointer dereference, causing the rpd process to crash and resulting in a denial of service condition. The flaw does not impact confidentiality or integrity but affects system availability. Multiple versions across Junos OS and Junos OS Evolved are affected, with specific version ranges detailed in the affectedVersions field. There is no indication of known exploits in the wild. The CVSS vector is AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, reflecting a network-adjacent attack vector with low complexity and no privileges or user interaction required.

Successful exploitation results in a denial of service by crashing the routing protocol daemon, disrupting routing operations on affected Junos OS devices. There is no impact on confidentiality or integrity. The medium severity rating reflects the availability impact and the ease of exploitation from an adjacent network position without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No vendor advisory or patch links are provided in the input data. Until an official fix is available, network administrators should monitor LDP sessions for anomalous activity and consider limiting LDP session adjacency to trusted devices. Avoid exposure of LDP sessions to untrusted networks. Follow Juniper Networks' official advisories for updates and patches.