CVE-2026-102021: Junos OS and Junos OS Evolved: Malformed RSVP packet causes rpd crash when MPLS-TE error processing is enabled

Medium severity · published Oct 14, 2026

CVE-2026-102021

Junos OS and Junos OS Evolved: Malformed RSVP packet causes rpd crash when MPLS-TE error processing is enabled

6.5

CVSS

0.3%

EPSS

On KEV

Description

A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent network attacker to cause a denial of service via a crafted RSVP packet when MPLS-TE RSVP processing is enabled. The condition can terminate rpd and disrupt routing protocol sessions.

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack vector

Adjacent

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

None

Integrity

None

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.3% · higher than 19% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Junos OS · Juniper

24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; 26.2 before 26.2R1-S2 · source: vendor

Junos OS Evolved · Juniper Networks

24.4 before 24.4R2-S5-EVO; 25.2 before 25.2R2-S2-EVO; 25.4 before 25.4R1-S3-EVO; 26.2 before 26.2R1-S2-EVO; 25.2X100 before 25.2X100-D35-EVO; 25.4X300 before 25.4X300-D40-EVO · source: vendor

Affected product

Junos OS

Juniper

All Junos OS CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-102021

CVE.org

https://www.cve.org/CVERecord?id=CVE-2026-102021

vendor-advisory

https://supportportal.juniper.net/JSA112187