CVE-2026-102011: CWE-617 Reachable Assertion in Juniper Networks Junos OS

This vulnerability (CVE-2026-102011) involves a reachable assertion in the rpd process of Juniper Networks Junos OS and Junos EVO. An adjacent attacker can trigger a denial of service condition by exploiting an LDP session where two misconfigured neighbors or a duplicated neighbor advertise the same transport address on a link-protected interface. This causes the rpd process to assert, leading to service disruption. The vulnerability affects a range of Junos OS and Junos EVO versions prior to certain patch releases, as detailed in the affectedVersions list. The CVSS 3.1 vector indicates the attack requires adjacent network access, low complexity, no privileges, no user interaction, and impacts availability only.

The vulnerability allows an adjacent attacker to cause a denial of service by crashing the rpd process, which can disrupt routing protocol operations on affected Junos OS and Junos EVO devices. There is no impact on confidentiality or integrity according to the CVSS vector. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch links are provided in the input data. Until patches are confirmed, avoid network configurations that allow two neighbors to advertise the same transport address on a link-protected interface, and monitor LDP session configurations to prevent misconfiguration or duplication. Follow Juniper Networks' official advisories for updates and patches.