Junos OS and Junos OS Evolved: Specific PIM messages causes rpd crash when multiple-triggered-joins is used (Juniper Networks Junos OS)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.27 % · percentile 19 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- juniper
- NVD status
- Awaiting Analysis
Description
A Use After Free vulnerability in the rpd PIM Join/Prune processing of Juniper Networks Junos OS and Junos OS Evolved platforms allows an unauthenticated adjacent attacker to crash the routing daemon via specific PIM messages when sparse mode PIM is configured.
Weaknesses (CWE)
- CWE-416 — Use After Free
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | juniper |
| CVSS 4.0 | HIGH 7.1 | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M | juniper |
| CVSS 4.0 | HIGH 7.1 | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X | NVD · sirt@juniper.net (Secondary) |
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD · sirt@juniper.net (Secondary) |
European references
- ENISA EUVD · EUVD-2026-101327
- GCVE · GCVE-0-2026-101970
CERT-FR advisories
- CERTFR-2026-AVI-1322 — Multiples vulnérabilités dans les produits Juniper Networks · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| Juniper Networks · Junos OS | affected 0 < 23.2R2-S7.7 ; affected 23.4 < 23.4R2-S8.13 ; affected 24.2 < 24.2R2-S5.5 ; affected 24.4 < 24.4R2-S5 ; affected 25.2 < 25.2R2-S2 ; affected 25.4 < 25.4R1-S3 |
| Juniper Networks · Junos OS Evolved | affected 0 < 23.2R2-S7.7-EVO ; affected 23.4 < 23.4R2-S8.11-EVO ; affected 24.2 < 24.2R2-S5.6-EVO ; affected 24.4 < 24.4R2-S5-EVO ; affected 25.2 < 25.2R2-S2-EVO ; affected 25.4 < 25.4R1-S3-EVO |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |