CVE-2026-101941: Junos OS and Junos OS Evolved: An attacker causes an rpd crash when routing-policy resolution-map processing and policy event tracing are enabled
A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP neighbor to cause a denial of service via a BGP route update when specific routing-policy resolution-map and policy event-tracing configuration is enabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Juniper Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 23.2R2-S7.7-EVO - Upgrade
Upgrade
Juniper Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 23.4R2-S8.11-EVO - Upgrade
Upgrade
Juniper Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 24.2R2-S5.6-EVO - Upgrade
Upgrade
Juniper Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 24.4R2-S5-EVO - Upgrade
Upgrade
Juniper Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 25.2R2-S2-EVO - Upgrade
Upgrade
Juniper Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 25.2X100-D35-EVO - Upgrade
Upgrade
Juniper Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 25.4R1-S3-EVO - Upgrade
Upgrade
Juniper Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 25.4R2-EVO - Upgrade
Upgrade
Juniper Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 25.4X300-D40-EVO - Upgrade
Upgrade
Juniper Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 26.2R1-S2-EVO - Upgrade
Upgrade
Juniper Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 26.2R2-EVO - Upgrade
Upgrade
Juniper Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 26.4R1-EVO - Upgrade
Upgrade
Juniper Junos OSto a version that resolves this vulnerability.Fixed in 23.2R2-S7.7 - Upgrade
Upgrade
Juniper Junos OSto a version that resolves this vulnerability.Fixed in 23.4R2-S8.13 - Upgrade
Upgrade
Juniper Junos OSto a version that resolves this vulnerability.Fixed in 24.2R2-S5.5 - Upgrade
Upgrade
Juniper Junos OSto a version that resolves this vulnerability.Fixed in 24.4R2-S5 - Upgrade
Upgrade
Juniper Junos OSto a version that resolves this vulnerability.Fixed in 25.2R2-S2 - Upgrade
Upgrade
Juniper Junos OSto a version that resolves this vulnerability.Fixed in 25.4R1-S3 - Upgrade
Upgrade
Juniper Junos OSto a version that resolves this vulnerability.Fixed in 25.4R2 - Upgrade
Upgrade
Juniper Junos OSto a version that resolves this vulnerability.Fixed in 26.2R1-S2 - Upgrade
Upgrade
Juniper Junos OSto a version that resolves this vulnerability.Fixed in 26.2R2 - Upgrade
Upgrade
Juniper Junos OSto a version that resolves this vulnerability.Fixed in 26.4R1
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Junos OS and Junos OS Evolved systems are exposed when they have a configured BGP neighbor and the specific routing-policy resolution-map and policy event-tracing configuration is enabled.
What does an attacker need to do to trigger the denial of service?
The attacker must be a configured BGP neighbor and send a BGP route update. Exploitation causes the routing protocol daemon (rpd) to crash.
Is a default BGP configuration affected?
The issue requires specific routing-policy resolution-map and policy event-tracing configuration to be enabled. The provided information does not establish that default configurations enable these features.
What configuration should be reviewed during triage?
Review whether the device has configured BGP neighbors and whether routing-policy resolution-map processing and policy event tracing are enabled. Devices meeting both conditions are within the described exposure scenario.