CVE-2026-102040: CWE-476 NULL Pointer Dereference in Juniper Networks Junos OS

This vulnerability (CVE-2026-102040) involves a NULL Pointer Dereference in the rpd routing daemon component of Juniper Networks Junos OS and Junos OS Evolved. An attacker with adjacent network access and no authentication can exploit this by sending a malicious RSVP Path message, triggering a crash of the routing daemon and resulting in denial of service. The affected versions span multiple release trains and specific builds of Junos OS and Junos OS Evolved, including versions prior to 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 26.2R1-S2 and their corresponding EVO variants and specific X-series builds. The vulnerability does not impact confidentiality or integrity but causes service disruption.

The impact is a denial of service condition caused by crashing the routing daemon (rpd) on affected Junos OS devices. This disrupts routing functionality but does not compromise confidentiality or integrity of data. The attacker requires adjacent network access and no privileges or user interaction are needed. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, network administrators should consider limiting adjacency or RSVP message acceptance from untrusted sources to reduce exposure. Monitor vendor advisories for official fixes and apply them promptly once released.