CVE-2026-102039: Junos OS and Junos OS Evolved: An attacker causes routing-process denial of service when GMPLS EVPL dynamic transport is used

Published Oct 14, 2026

Updated

A NULL Pointer Dereference vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause a denial of service via a malformed RSVP Path message received on an EVPL LMP control channel.

Affected Software

2 affected components

Juniper Networks Junos OS

Juniper Networks Junos OS Evolved

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 23.2R2-S7.7-EVO
Upgrade
Upgrade Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 23.4R2-S8.11-EVO
Upgrade
Upgrade Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 24.2R2-S5.6-EVO
Upgrade
Upgrade Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 24.4R2-S5-EVO
Upgrade
Upgrade Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 25.2R2-S2-EVO
Upgrade
Upgrade Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 25.2X100-D35-EVO
Upgrade
Upgrade Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 25.4R1-S3-EVO
Upgrade
Upgrade Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 25.4R2-EVO
Upgrade
Upgrade Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 25.4X300-D40-EVO
Upgrade
Upgrade Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 26.2R1-S2-EVO
Upgrade
Upgrade Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 26.2R2-EVO
Upgrade
Upgrade Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 26.4R1-EVO
Upgrade
Upgrade Junos OS to a version that resolves this vulnerability.
Fixed in 23.2R2-S7.7
Upgrade
Upgrade Junos OS to a version that resolves this vulnerability.
Fixed in 23.4R2-S8.13
Upgrade
Upgrade Junos OS to a version that resolves this vulnerability.
Fixed in 24.2R2-S5.5
Upgrade
Upgrade Junos OS to a version that resolves this vulnerability.
Fixed in 24.4R2-S5
Upgrade
Upgrade Junos OS to a version that resolves this vulnerability.
Fixed in 25.2R2-S2
Upgrade
Upgrade Junos OS to a version that resolves this vulnerability.
Fixed in 25.4R1-S3
Upgrade
Upgrade Junos OS to a version that resolves this vulnerability.
Fixed in 25.4R2
Upgrade
Upgrade Junos OS to a version that resolves this vulnerability.
Fixed in 26.2R1-S2
Upgrade
Upgrade Junos OS to a version that resolves this vulnerability.
Fixed in 26.2R2
Upgrade
Upgrade Junos OS to a version that resolves this vulnerability.
Fixed in 26.4R1

Event History

Oct 14, 2026

CVE Published

via MITRE·04:51 PM

Data Sourced

via MITRE·04:51 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Junos OS and Junos OS Evolved deployments using GMPLS EVPL dynamic transport are exposed when an EVPL LMP control channel can receive RSVP Path messages from an adjacent attacker.

What does an attacker need to exploit the vulnerability?

The attacker must be adjacent to the affected device and able to send a malformed RSVP Path message on an EVPL LMP control channel. No privileges or user interaction are required.

What is the impact of successful exploitation?

Successful exploitation causes a NULL pointer dereference in the rpd routing process, resulting in denial of service. The provided data does not indicate confidentiality or integrity impact.