CVE-2026-101989: CWE-617 Reachable Assertion in Juniper Networks Junos OS

This vulnerability (CVE-2026-101989) involves a reachable assertion failure in the routing protocol daemon (rpd) component of Juniper Networks Junos OS and Junos OS Evolved. An attacker who is a compromised LDP neighbor can send a crafted LDP message that triggers an assertion failure, causing the rpd process to crash. This leads to a denial of service condition affecting routing functionality. The vulnerability does not allow for privilege escalation, data disclosure, or data modification. Multiple versions of Junos OS and Junos OS Evolved are affected, with specific version ranges detailed in the affectedVersions field.

Successful exploitation results in a denial of service condition by crashing the routing protocol daemon (rpd), which can disrupt routing operations on affected devices. There is no impact on confidentiality or integrity. The attack vector requires network access as an LDP neighbor, with low attack complexity and no privileges or user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, network administrators should consider restricting LDP neighbor access to trusted devices only and monitor for unusual LDP traffic to mitigate potential exploitation.