CVE-2026-101961
CVE-2026-101961 · Junos OS and Junos OS Evolved: A specific BGP packet causes an rpd crash when an ECMP qualifier is used in an import policy
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A NULL Pointer Dereference vulnerability in the routing-policy nexthop-ECMP matcher of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP peer to cause a routing-daemon denial of service via a specific BGP packet received while a nexthop-ecmp qualifier is attached to a BGP import policy.
CVSS 8.7 · High · EPSS 0.4% · Fix available
- Published
- Updated
Affected products and versions
junos os
- Versions
- ≥ 23.4, < 23.4R2-S8.13: Affected (custom)
- ≥ 24.2, < 24.2R2-S5.5: Affected (custom)
- ≥ 24.4, < 24.4R2-S5: Affected (custom)
- ≥ 25.2, < 25.2R2-S2: Affected (custom)
- ≥ 25.4, < 25.4R1-S3: Affected (custom)
- ≥ 26.2, < 26.2R1-S2: Affected (custom)
No fix published
junos os evolved
- Versions
- ≥ 23.4, < 23.4R2-S8.11-EVO: Affected (custom)
- ≥ 24.2, < 24.2R2-S5.6-EVO: Affected (custom)
- ≥ 24.4, < 24.4R2-S5-EVO: Affected (custom)
- ≥ 25.2, < 25.2R2-S2-EVO: Affected (custom)
- ≥ 25.4, < 25.4R1-S3-EVO: Affected (custom)
- ≥ 26.2, < 26.2R1-S2-EVO: Affected (custom)
- 23.4X100: Affected (custom)
- ≥ 25.2X100, < 25.2X100-D35-EVO: Affected (custom)
- ≥ 25.4X300, < 25.4X300-D40-EVO: Affected (custom)
Update to 24.2R2-S5.6-EVO