Skip to content
VulniPulse
Sign in
Advisory severityHigh7.5Juniper Networks Updated

High [CVE-2026-101949] NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated remote BGP neighbor to cause a denial of service via a VPN-flowspec BGP update if it is readvertised and BMP post-policy RIB-out monitoring is configured

This high-severity Juniper Networks advisory covers CVE-2026-101949 affecting Junos OS, Junos OS Evolved.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.

CVE-2026-101949 Source published Source updated

VulniPulse record published Record updated

CVE-2026-101949
Affected products & platforms
Juniper NetworksJunosJunos OS Evolved
Open source advisory

Android app · Google Play

Monitor future Juniper Networks CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features

Summary

A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated remote BGP neighbor to cause a denial of service via a VPN-flowspec BGP update if it is readvertised and BMP post-policy RIB-out monitoring is configured.

Affected versions
  • Junos OS before 23.2R2-S7.7
  • Junos OS 23.4 before 23.4R2-S8.13
  • Junos OS 24.2 before 24.2R2-S5.5
  • Junos OS 24.4 before 24.4R2-S5
  • Junos OS 25.2 before 25.2R2-S2
  • Junos OS 25.4 before 25.4R1-S3
  • Junos OS 26.2 before 26.2R1-S2
  • Junos OS Evolved before 23.2R2-S7.7-EVO
  • Junos OS Evolved 23.4 before 23.4R2-S8.11-EVO
  • Junos OS Evolved 24.2 before 24.2R2-S5.6-EVO
  • Junos OS Evolved 24.4 before 24.4R2-S5-EVO
  • Junos OS Evolved 25.2 before 25.2R2-S2-EVO

Official advisory · high-confidence parse· fetched 7 days ago·verify at source

Fixed versions
  • 23.2R2-S7.7
  • 23.4R2-S8.13
  • 24.2R2-S5.5
  • 24.4R2-S5
  • 25.2R2-S2
  • 25.4R1-S3
  • 26.2R1-S2
  • 23.2R2-S7.7-EVO
  • 23.4R2-S8.11-EVO
  • 24.2R2-S5.6-EVO
  • 24.4R2-S5-EVO
  • 25.2R2-S2-EVO

Official advisory · high-confidence parse· fetched 7 days ago·verify at source

Mitigation checklist

Recommended fix / mitigation
  • A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated remote BGP neighbor to cause a denial of service via a VPN-flowspec BGP update if it is readvertised and BMP post-policy RIB-out monitoring is configured.

Official advisory · high-confidence parse· fetched 7 days ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

Sign in to join the discussion.