High priorityDisclosed

Advisory · CVE-2026-101939

NULL pointer flaw in Junos rpd lets a BGP peer crash the daemon under a forwarding policy

A NULL pointer dereference in the routing protocol daemon (RPD) of Junos OS and Junos OS Evolved lets a configured peer sending a BGP UPDATE cause a denial of service when an import policy with source-based-forwarding next-hop next-table references a routing table that does not exist. Juniper rates it CVSS 4.0 8.7 (CVSS 3.1 7.5).

Advisory published October 14, 2026Independent summary
Vendor
Juniper Networks
Product
Junos OS
Identifier / CWE
CVE-2026-101939
CWE-476
Action timing
Immediate
ELI5

Explain it like I’m five

A policy points at a routing table that is not there, and the daemon follows the pointer off a cliff when a peer's update arrives.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Trigger input

    An attacker sends the crafted protocol traffic described for CVE-2026-101939.

  2. 02Weakness trips

    The daemon mishandles the input through the null pointer dereference weakness.

  3. 03Impact lands

    The routing or control-plane daemon crashes or misbehaves as described.

What happened

Juniper disclosed CVE-2026-101939 in its October 2026 security release: a NULL pointer dereference (CWE-476) in RPD. A configured peer’s BGP UPDATE triggers it when an import policy uses then source-based-forwarding next-hop next-table against a routing table that does not exist, denying service.

Juniper’s JSA112187 lists the affected service releases and the October 2026 service release thresholds that carry the fix. Match your exact release to the advisory rather than guessing here.

What to do

  1. Inventory every Junos OS deployment, including test, training, and individually managed instances.
  2. Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
  3. Restrict network access to Junos OS while remediation is underway, especially for internet-facing instances.
  4. Review application and server logs for rpd crashes following BGP updates on devices whose import policies use source-based-forwarding next-table.
  5. Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
  6. Verify the deployed version or patch level after remediation.

Management note

One missing table plus one peer update equals a routing outage. Patch, and clean up policies that reference tables you deleted.