CVE-2026-102021: Junos OS and Junos OS Evolved: Malformed RSVP packet causes rpd crash when MPLS-TE error processing is enabled

Published Oct 14, 2026

Updated

A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent network attacker to cause a denial of service via a crafted RSVP packet when MPLS-TE RSVP processing is enabled. The condition can terminate rpd and disrupt routing protocol sessions.

Affected Software

2 affected components

Juniper Networks Junos OS

Juniper Networks Junos OS Evolved

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Juniper Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 24.4R2-S5-EVO
Upgrade
Upgrade Juniper Junos OS to a version that resolves this vulnerability.
Fixed in 24.4R2-S5

Event History

Oct 14, 2026

CVE Published

via MITRE·04:46 PM

Data Sourced

via MITRE·04:46 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker on an adjacent network can exploit it by sending a crafted RSVP packet. No privileges or user interaction are required.

What configuration is required for exposure?

The affected device must have MPLS-TE RSVP processing enabled. The provided information does not establish that devices without this processing enabled are affected.

What is the operational impact of successful exploitation?

Successful exploitation can terminate the routing protocol daemon (rpd), causing a denial of service. Routing protocol sessions may be disrupted as a result.