CVE-2026-102029: CWE-476 NULL Pointer Dereference in Juniper Networks Junos OS
Description
CVE-2026-102029 is a NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. It allows an unauthenticated configured MSDP peer or adjacent PIM sender to cause a denial of service via an MSDP or PIM policy that uses AS-path expansion. The vulnerability has a high severity with a CVSS score of 7.5 and affects multiple versions of Junos OS and Junos OS Evolved prior to specific fixed releases.
CVSS v3.1
Score 7.5high
Affected software
Juniper Networks
Junos OS
Juniper Networks
Junos OS Evolved
pkg:rpm/juniper/junos-ospkg:rpm/juniper/junos-os-evoRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CVE-2026-102029) involves a NULL Pointer Dereference in the routing protocol daemon (rpd) component of Juniper Networks Junos OS and Junos OS Evolved. An unauthenticated configured MSDP peer or adjacent PIM sender can exploit this flaw by leveraging an MSDP or PIM policy that uses AS-path expansion, causing the rpd process to crash and resulting in a denial of service condition. The issue affects a broad range of Junos OS versions prior to the indicated fixed releases.
Potential Impact
Successful exploitation results in a denial of service (DoS) condition due to the NULL Pointer Dereference in the rpd process. There is no impact on confidentiality or integrity, but availability is affected as the routing daemon may crash, potentially disrupting network routing functions.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until official patches or fixes are available, restrict or monitor MSDP and PIM peer configurations to trusted entities to reduce exposure. No vendor advisory content or patch links were provided in the input data, so confirm remediation status directly with Juniper Networks.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- juniper
- Date Reserved
- 2026-09-28T17:33:49.411Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6acfb6742cdf04f65697951f
Added to database: 10/14/2026, 17:05:56 UTC
Last enriched: 10/14/2026, 17:18:24 UTC
Last updated: 10/14/2026, 19:00:32 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.