CVE-2026-102040: Junos OS and Junos OS Evolved: An attacker crashes the routing daemon when co-routed bidirectional RSVP LSPs are used

Published Oct 14, 2026

Updated

A NULL Pointer Dereference vulnerability in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to crash the routing daemon and cause a denial of service via an RSVP Path message.

Affected Software

2 affected components

Juniper Networks Junos OS

Juniper Networks Junos OS Evolved

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 23.2R2-S7.7-EVO
Upgrade
Upgrade Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 23.4R2-S8.11-EVO
Upgrade
Upgrade Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 24.2R2-S5.6-EVO
Upgrade
Upgrade Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 24.4R2-S5-EVO
Upgrade
Upgrade Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 25.2R2-S2-EVO
Upgrade
Upgrade Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 25.2X100-D35-EVO
Upgrade
Upgrade Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 25.4R1-S3-EVO
Upgrade
Upgrade Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 25.4R2-EVO
Upgrade
Upgrade Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 25.4X300-D40-EVO
Upgrade
Upgrade Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 26.2R1-S2-EVO
Upgrade
Upgrade Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 26.2R2-EVO
Upgrade
Upgrade Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 26.4R1-EVO
Upgrade
Upgrade Junos OS to a version that resolves this vulnerability.
Fixed in 23.2R2-S7.7
Upgrade
Upgrade Junos OS to a version that resolves this vulnerability.
Fixed in 23.4R2-S8.13
Upgrade
Upgrade Junos OS to a version that resolves this vulnerability.
Fixed in 24.2R2-S5.5
Upgrade
Upgrade Junos OS to a version that resolves this vulnerability.
Fixed in 24.4R2-S5
Upgrade
Upgrade Junos OS to a version that resolves this vulnerability.
Fixed in 25.2R2-S2
Upgrade
Upgrade Junos OS to a version that resolves this vulnerability.
Fixed in 25.4R1-S3
Upgrade
Upgrade Junos OS to a version that resolves this vulnerability.
Fixed in 25.4R2
Upgrade
Upgrade Junos OS to a version that resolves this vulnerability.
Fixed in 26.2R1-S2
Upgrade
Upgrade Junos OS to a version that resolves this vulnerability.
Fixed in 26.2R2
Upgrade
Upgrade Junos OS to a version that resolves this vulnerability.
Fixed in 26.4R1

Event History

Oct 14, 2026

CVE Published

via MITRE·04:51 PM

Data Sourced

via MITRE·04:51 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this vulnerability?

An adjacent attacker does not need authentication or user interaction. Exploitation requires the attacker to be able to send an RSVP Path message to the affected device.

Which deployments are exposed?

The issue applies when co-routed bidirectional RSVP LSPs are used. The provided information does not establish whether such LSPs are enabled by default.

What is the impact of a successful exploit?

A successful exploit can crash the rpd routing daemon, causing a denial of service. No confidentiality or integrity impact is indicated by the supplied CVSS vector.