Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.7

Juniper Junos can crash routing daemon from crafted BGP packet

CVE-2026-101961 · published 21 days ago
Summary

Juniper's Junos OS and Junos OS Evolved may stop their routing process if they receive a specially formed BGP message while a specific import rule is active. This can cause a temporary loss of routing services, affecting network connectivity. Apply the vendor's update or remove the ECMP qualifier from the import policy to prevent the issue.

What to do
  • Update juniper networks junos os to version 23.4R2-S8.13 or later.
  • Update juniper networks junos os evolved to version 23.4R2-S8.11-EVO or later.
Affected software
VendorProductAffected versions
juniper networks junos os < 23.4R2-S8.13
juniper networks junos os evolved < 23.4R2-S8.11-EVO
Original advisory text
Junos OS and Junos OS Evolved: A specific BGP packet causes an rpd crash when an ECMP qualifier is used in an import policy
A NULL Pointer Dereference vulnerability in the routing-policy nexthop-ECMP matcher of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP peer to cause a routing-daemon denial of service via a specific BGP packet received while a nexthop-ecmp qualifier is attached to a BGP import policy.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
8.7 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-476NULL Pointer Dereference
Timeline
Published14 Oct 2026
Updated4 Nov 2026
First seen14 Oct 2026
Sources
CVE-2026-101961 · NVD
CVE-2026-101961 · MITRE
Track software like this
Free during beta