CVE-2026-101999: CWE-617 Reachable Assertion in Juniper Networks Junos OS

This vulnerability (CVE-2026-101999) involves a reachable assertion flaw in the rpd process of Juniper Networks Junos OS and Junos EVO. An attacker with adjacency can send a Label Distribution Protocol (LDP) message containing an IPv6 Prefix Forwarding Equivalence Class (FEC) that triggers an assertion failure, resulting in a denial of service condition. The issue affects a range of Junos OS and Junos EVO versions prior to certain maintenance releases. The CVSS 3.1 vector indicates the attack requires adjacent network access, low attack complexity, no privileges or user interaction, and impacts availability only.

Successful exploitation leads to denial of service by crashing or disrupting the rpd process, which is critical for routing protocol operations. There is no impact on confidentiality or integrity. The attack requires adjacency, limiting the attack surface to local or directly connected attackers. No known active exploitation has been reported.

Patch status is not confirmed in the provided data; no vendor advisory or patch links are included. Users should consult Juniper Networks' official advisories for updates and apply patches or mitigations as recommended. Until patches are confirmed, restricting adjacency-level access to trusted entities and monitoring LDP sessions may reduce exposure.