CVE-2026-101939: Junos OS and Junos OS Evolved: A routing-policy table reference causes routing-daemon denial of service when source-based forwarding is used
A NULL Pointer Dereference vulnerability in the routing protocol daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows a configured peer sending a BGP UPDATE to cause a denial of service when an import policy with then source-based-forwarding next-hop next-table <X> is configured to reference a routing table that does not exist.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Juniper Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 23.2R2-S7.7-EVO - Upgrade
Upgrade
Juniper Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 23.4R2-S8.11-EVO - Upgrade
Upgrade
Juniper Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 24.2R2-S5.6-EVO - Upgrade
Upgrade
Juniper Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 24.4R2-S5-EVO - Upgrade
Upgrade
Juniper Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 25.2R2-S2-EVO - Upgrade
Upgrade
Juniper Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 25.2X100-D35-EVO - Upgrade
Upgrade
Juniper Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 25.4R1-S3-EVO - Upgrade
Upgrade
Juniper Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 25.4R2-EVO - Upgrade
Upgrade
Juniper Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 25.4X300-D40-EVO - Upgrade
Upgrade
Juniper Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 26.2R1-S2-EVO - Upgrade
Upgrade
Juniper Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 26.2R2-EVO - Upgrade
Upgrade
Juniper Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 26.4R1-EVO - Upgrade
Upgrade
Juniper Junos OSto a version that resolves this vulnerability.Fixed in 23.2R2-S7.7 - Upgrade
Upgrade
Juniper Junos OSto a version that resolves this vulnerability.Fixed in 23.4R2-S8.13 - Upgrade
Upgrade
Juniper Junos OSto a version that resolves this vulnerability.Fixed in 24.2R2-S5.5 - Upgrade
Upgrade
Juniper Junos OSto a version that resolves this vulnerability.Fixed in 24.4R2-S5 - Upgrade
Upgrade
Juniper Junos OSto a version that resolves this vulnerability.Fixed in 25.2R2-S2 - Upgrade
Upgrade
Juniper Junos OSto a version that resolves this vulnerability.Fixed in 25.4R1-S3 - Upgrade
Upgrade
Juniper Junos OSto a version that resolves this vulnerability.Fixed in 25.4R2 - Upgrade
Upgrade
Juniper Junos OSto a version that resolves this vulnerability.Fixed in 26.2R1-S2 - Upgrade
Upgrade
Juniper Junos OSto a version that resolves this vulnerability.Fixed in 26.2R2 - Upgrade
Upgrade
Juniper Junos OSto a version that resolves this vulnerability.Fixed in 26.4R1
Event History
Frequently Asked Questions
Who can trigger the denial of service?
A configured BGP peer can trigger it by sending a BGP UPDATE. The issue is not described as requiring authentication beyond being a configured peer.
What configuration is required for exploitation?
An import policy must use `then source-based-forwarding next-hop next-table <X>` and reference a routing table that does not exist. Without that policy condition and invalid table reference, the described trigger does not apply.
What can be done if an update cannot be applied immediately?
Review import policies for source-based-forwarding next-hop actions that reference nonexistent routing tables, and correct or remove those references. This prevents the configuration condition described for the RPD denial of service.
How can administrators identify potentially affected systems?
Check Junos OS and Junos OS Evolved configurations for BGP import policies containing `then source-based-forwarding next-hop next-table <X>`, then verify that each referenced routing table exists. A potentially affected system may experience an RPD denial of service after a configured peer sends a BGP UPDATE.