CVE-2026-21909

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-21909", "assignerOrgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968", "state": "PUBLISHED", "assignerShortName": "juniper", "dateReserved": "2026-01-05T17:32:48.710Z", "datePublished": "2026-01-15T20:22:44.674Z", "dateUpdated": "2026-01-15T20:52:42.400Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Junos OS", "vendor": "Juniper Networks", "versions": [{"lessThan": "23.2R2", "status": "affected", "version": "23.2", "versionType": "semver"}, {"lessThan": "23.4R1-S2, 23.4R2", "status": "affected", "version": "23.4", "versionType": "semver"}, {"lessThan": "24.1R2", "status": "affected", "version": "24.1", "versionType": "semver"}, {"lessThan": "23.2R1", "status": "unaffected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Junos OS Evolved", "vendor": "Juniper Networks", "versions": [{"lessThan": "23.2R2-EVO", "status": "affected", "version": "23.2", "versionType": "semver"}, {"lessThan": "23.4R1-S2-EVO, 23.4R2-EVO", "status": "affected", "version": "23.4", "versionType": "semver"}, {"lessThan": "24.1R2-EVO", "status": "affected", "version": "24.1", "versionType": "semver"}, {"lessThan": "23.2R1-EVO", "status": "unaffected", "version": "0", "versionType": "semver"}]}], "configurations": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "This issue affects systems with IS-IS configured. For example:<br><br><tt>[protocols isis interface lo.0 ...]<br>\n\n[protocols isis interface &lt;interface&gt; ...]<br>[interfaces &lt;interface&gt; unit &lt;n&gt; family iso]</tt>"}], "value": "This issue affects systems with IS-IS configured. For example:\n\n[protocols isis interface lo.0 ...]\n\n\n[protocols isis interface <interface> ...]\n[interfaces <interface> unit <n> family iso]"}], "datePublic": "2026-01-14T17:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "A Missing Release of Memory after Effective Lifetime vulnerability in the routing protocol daemon (rpd) Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated attacker controlling an adjacent IS-IS neighbor to send a specific update packet causing a memory leak.&nbsp;Continued receipt and processing of these packets will exhaust all available memory, crashing rpd and creating a Denial of Service (DoS) condition.<br><br>Memory usage can be monitored through the use of the 'show task memory detail' command. For example:<br><br><tt>user@junos&gt; show task memory detail | match ted-infra<br>&nbsp; TED-INFRA-COOKIE &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 25 &nbsp; 1072 &nbsp; &nbsp; 28 &nbsp; 1184 &nbsp; &nbsp; 229<br></tt><br>\n\n<tt>user@junos&gt; \n\nshow task memory detail | match ted-infra<br>&nbsp; TED-INFRA-COOKIE &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <b><span style=\"background-color: rgb(239, 250, 102);\">31</span></b> &nbsp; <b><span style=\"background-color: rgb(239, 250, 102);\">1360</span></b> &nbsp; &nbsp; 34 &nbsp; 1472 &nbsp; &nbsp; 307</tt><br><br><p>This issue affects:</p><p>Junos OS:&nbsp;</p><ul><li>from 23.2 before 23.2R2,&nbsp;</li><li>from 23.4 before 23.4R1-S2, 23.4R2,&nbsp;</li><li>from 24.1 before 24.1R2;&nbsp;</li></ul><p>Junos OS Evolved:&nbsp;</p><ul><li>from 23.2 before 23.2R2-EVO,&nbsp;</li><li>from 23.4 before 23.4R1-S2-EVO, 23.4R2-EVO,&nbsp;</li><li>from 24.1 before 24.1R2-EVO.</li></ul>This issue does not affect Junos OS versions before 23.2R1 or Junos OS Evolved versions before 23.2R1-EVO."}], "value": "A Missing Release of Memory after Effective Lifetime vulnerability in the routing protocol daemon (rpd) Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated attacker controlling an adjacent IS-IS neighbor to send a specific update packet causing a memory leak.\u00a0Continued receipt and processing of these packets will exhaust all available memory, crashing rpd and creating a Denial of Service (DoS) condition.\n\nMemory usage can be monitored through the use of the 'show task memory detail' command. For example:\n\nuser@junos> show task memory detail | match ted-infra\n\u00a0 TED-INFRA-COOKIE \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 25 \u00a0 1072 \u00a0 \u00a0 28 \u00a0 1184 \u00a0 \u00a0 229\n\n\n\nuser@junos> \n\nshow task memory detail | match ted-infra\n\u00a0 TED-INFRA-COOKIE \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 31 \u00a0 1360 \u00a0 \u00a0 34 \u00a0 1472 \u00a0 \u00a0 307\n\nThis issue affects:\n\nJunos OS:\u00a0\n\n * from 23.2 before 23.2R2,\u00a0\n * from 23.4 before 23.4R1-S2, 23.4R2,\u00a0\n * from 24.1 before 24.1R2;\u00a0\n\n\nJunos OS Evolved:\u00a0\n\n * from 23.2 before 23.2R2-EVO,\u00a0\n * from 23.4 before 23.4R1-S2-EVO, 23.4R2-EVO,\u00a0\n * from 24.1 before 24.1R2-EVO.\n\n\nThis issue does not affect Junos OS versions before 23.2R1 or Junos OS Evolved versions before 23.2R1-EVO."}], "exploits": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."}], "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"cvssV4_0": {"Automatable": "YES", "Recovery": "AUTOMATIC", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "baseScore": 7.1, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "providerUrgency": "GREEN", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "CONCENTRATED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M/U:Green", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "MODERATE"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-401", "description": "CWE-401 Missing Release of Memory after Effective Lifetime", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968", "shortName": "juniper", "dateUpdated": "2026-01-15T20:22:44.674Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://supportportal.juniper.net/JSA106008"}, {"tags": ["vendor-advisory"], "url": "https://kb.juniper.net/JSA106008"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The following software releases have been updated to resolve this specific issue:<br>Junos OS:&nbsp;23.2R2, 23.4R1-S2, 23.4R2, 24.1R2, 24.2R1<span style=\"background-color: rgb(255, 255, 255);\">, and all subsequent releases.</span>\n\n<br> Junos OS Evolved:&nbsp;23.2R2-EVO, 23.4R1-S2-EVO, 23.4R2-EVO, 24.1R2-EVO, 24.2R1-EVO,&nbsp;<span style=\"background-color: rgb(255, 255, 255);\">and all subsequent releases.</span>\n\n<br><br><br>"}], "value": "The following software releases have been updated to resolve this specific issue:\nJunos OS:\u00a023.2R2, 23.4R1-S2, 23.4R2, 24.1R2, 24.2R1, and all subsequent releases.\n\n\n Junos OS Evolved:\u00a023.2R2-EVO, 23.4R1-S2-EVO, 23.4R2-EVO, 24.1R2-EVO, 24.2R1-EVO,\u00a0and all subsequent releases."}], "source": {"advisory": "JSA106008", "defect": ["1793982"], "discovery": "USER"}, "title": "Junos OS and Junos OS Evolved: Receipt of specific IS-IS update packet causes memory leak leading to RPD crash", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "There are no known workarounds for this issue."}], "value": "There are no known workarounds for this issue."}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-15T20:52:37.531214Z", "id": "CVE-2026-21909", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-15T20:52:42.400Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-21909", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-15T20:52:37.531214Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-15T20:52:39.114Z"}}], "cna": {"title": "Junos OS and Junos OS Evolved: Receipt of specific IS-IS update packet causes memory leak leading to RPD crash", "source": {"defect": ["1793982"], "advisory": "JSA106008", "discovery": "USER"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "AUTOMATIC", "baseScore": 7.1, "Automatable": "YES", "attackVector": "ADJACENT", "baseSeverity": "HIGH", "valueDensity": "CONCENTRATED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M/U:Green", "providerUrgency": "GREEN", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "MODERATE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Juniper Networks", "product": "Junos OS", "versions": [{"status": "affected", "version": "23.2", "lessThan": "23.2R2", "versionType": "semver"}, {"status": "affected", "version": "23.4", "lessThan": "23.4R1-S2, 23.4R2", "versionType": "semver"}, {"status": "affected", "version": "24.1", "lessThan": "24.1R2", "versionType": "semver"}, {"status": "unaffected", "version": "0", "lessThan": "23.2R1", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Juniper Networks", "product": "Junos OS Evolved", "versions": [{"status": "affected", "version": "23.2", "lessThan": "23.2R2-EVO", "versionType": "semver"}, {"status": "affected", "version": "23.4", "lessThan": "23.4R1-S2-EVO, 23.4R2-EVO", "versionType": "semver"}, {"status": "affected", "version": "24.1", "lessThan": "24.1R2-EVO", "versionType": "semver"}, {"status": "unaffected", "version": "0", "lessThan": "23.2R1-EVO", "versionType": "semver"}], "defaultStatus": "unaffected"}], "exploits": [{"lang": "en", "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability.", "supportingMedia": [{"type": "text/html", "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability.", "base64": false}]}], "solutions": [{"lang": "en", "value": "The following software releases have been updated to resolve this specific issue:\nJunos OS:\u00a023.2R2, 23.4R1-S2, 23.4R2, 24.1R2, 24.2R1, and all subsequent releases.\n\n\n Junos OS Evolved:\u00a023.2R2-EVO, 23.4R1-S2-EVO, 23.4R2-EVO, 24.1R2-EVO, 24.2R1-EVO,\u00a0and all subsequent releases.", "supportingMedia": [{"type": "text/html", "value": "The following software releases have been updated to resolve this specific issue:<br>Junos OS:&nbsp;23.2R2, 23.4R1-S2, 23.4R2, 24.1R2, 24.2R1<span style=\"background-color: rgb(255, 255, 255);\">, and all subsequent releases.</span>\n\n<br> Junos OS Evolved:&nbsp;23.2R2-EVO, 23.4R1-S2-EVO, 23.4R2-EVO, 24.1R2-EVO, 24.2R1-EVO,&nbsp;<span style=\"background-color: rgb(255, 255, 255);\">and all subsequent releases.</span>\n\n<br><br><br>", "base64": false}]}], "datePublic": "2026-01-14T17:00:00.000Z", "references": [{"url": "https://supportportal.juniper.net/JSA106008", "tags": ["vendor-advisory"]}, {"url": "https://kb.juniper.net/JSA106008", "tags": ["vendor-advisory"]}], "workarounds": [{"lang": "en", "value": "There are no known workarounds for this issue.", "supportingMedia": [{"type": "text/html", "value": "There are no known workarounds for this issue.", "base64": false}]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "A Missing Release of Memory after Effective Lifetime vulnerability in the routing protocol daemon (rpd) Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated attacker controlling an adjacent IS-IS neighbor to send a specific update packet causing a memory leak.\u00a0Continued receipt and processing of these packets will exhaust all available memory, crashing rpd and creating a Denial of Service (DoS) condition.\n\nMemory usage can be monitored through the use of the 'show task memory detail' command. For example:\n\nuser@junos> show task memory detail | match ted-infra\n\u00a0 TED-INFRA-COOKIE \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 25 \u00a0 1072 \u00a0 \u00a0 28 \u00a0 1184 \u00a0 \u00a0 229\n\n\n\nuser@junos> \n\nshow task memory detail | match ted-infra\n\u00a0 TED-INFRA-COOKIE \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 31 \u00a0 1360 \u00a0 \u00a0 34 \u00a0 1472 \u00a0 \u00a0 307\n\nThis issue affects:\n\nJunos OS:\u00a0\n\n * from 23.2 before 23.2R2,\u00a0\n * from 23.4 before 23.4R1-S2, 23.4R2,\u00a0\n * from 24.1 before 24.1R2;\u00a0\n\n\nJunos OS Evolved:\u00a0\n\n * from 23.2 before 23.2R2-EVO,\u00a0\n * from 23.4 before 23.4R1-S2-EVO, 23.4R2-EVO,\u00a0\n * from 24.1 before 24.1R2-EVO.\n\n\nThis issue does not affect Junos OS versions before 23.2R1 or Junos OS Evolved versions before 23.2R1-EVO.", "supportingMedia": [{"type": "text/html", "value": "A Missing Release of Memory after Effective Lifetime vulnerability in the routing protocol daemon (rpd) Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated attacker controlling an adjacent IS-IS neighbor to send a specific update packet causing a memory leak.&nbsp;Continued receipt and processing of these packets will exhaust all available memory, crashing rpd and creating a Denial of Service (DoS) condition.<br><br>Memory usage can be monitored through the use of the 'show task memory detail' command. For example:<br><br><tt>user@junos&gt; show task memory detail | match ted-infra<br>&nbsp; TED-INFRA-COOKIE &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 25 &nbsp; 1072 &nbsp; &nbsp; 28 &nbsp; 1184 &nbsp; &nbsp; 229<br></tt><br>\n\n<tt>user@junos&gt; \n\nshow task memory detail | match ted-infra<br>&nbsp; TED-INFRA-COOKIE &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <b><span style=\"background-color: rgb(239, 250, 102);\">31</span></b> &nbsp; <b><span style=\"background-color: rgb(239, 250, 102);\">1360</span></b> &nbsp; &nbsp; 34 &nbsp; 1472 &nbsp; &nbsp; 307</tt><br><br><p>This issue affects:</p><p>Junos OS:&nbsp;</p><ul><li>from 23.2 before 23.2R2,&nbsp;</li><li>from 23.4 before 23.4R1-S2, 23.4R2,&nbsp;</li><li>from 24.1 before 24.1R2;&nbsp;</li></ul><p>Junos OS Evolved:&nbsp;</p><ul><li>from 23.2 before 23.2R2-EVO,&nbsp;</li><li>from 23.4 before 23.4R1-S2-EVO, 23.4R2-EVO,&nbsp;</li><li>from 24.1 before 24.1R2-EVO.</li></ul>This issue does not affect Junos OS versions before 23.2R1 or Junos OS Evolved versions before 23.2R1-EVO.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-401", "description": "CWE-401 Missing Release of Memory after Effective Lifetime"}]}], "configurations": [{"lang": "en", "value": "This issue affects systems with IS-IS configured. For example:\n\n[protocols isis interface lo.0 ...]\n\n\n[protocols isis interface <interface> ...]\n[interfaces <interface> unit <n> family iso]", "supportingMedia": [{"type": "text/html", "value": "This issue affects systems with IS-IS configured. For example:<br><br><tt>[protocols isis interface lo.0 ...]<br>\n\n[protocols isis interface &lt;interface&gt; ...]<br>[interfaces &lt;interface&gt; unit &lt;n&gt; family iso]</tt>", "base64": false}]}], "providerMetadata": {"orgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968", "shortName": "juniper", "dateUpdated": "2026-01-15T20:22:44.674Z"}}}, "cveMetadata": {"cveId": "CVE-2026-21909", "state": "PUBLISHED", "dateUpdated": "2026-01-15T20:52:42.400Z", "dateReserved": "2026-01-05T17:32:48.710Z", "assignerOrgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968", "datePublished": "2026-01-15T20:22:44.674Z", "assignerShortName": "juniper"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Junos OS", "vendor": "Juniper Networks", "versions": [{"lessThan": "23.2R2", "status": "affected", "version": "23.2", "versionType": "semver"}, {"lessThan": "23.4R1-S2, 23.4R2", "status": "affected", "version": "23.4", "versionType": "semver"}, {"lessThan": "24.1R2", "status": "affected", "version": "24.1", "versionType": "semver"}, {"lessThan": "23.2R1", "status": "unaffected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Junos OS Evolved", "vendor": "Juniper Networks", "versions": [{"lessThan": "23.2R2-EVO", "status": "affected", "version": "23.2", "versionType": "semver"}, {"lessThan": "23.4R1-S2-EVO, 23.4R2-EVO", "status": "affected", "version": "23.4", "versionType": "semver"}, {"lessThan": "24.1R2-EVO", "status": "affected", "version": "24.1", "versionType": "semver"}, {"lessThan": "23.2R1-EVO", "status": "unaffected", "version": "0", "versionType": "semver"}]}], "source": "sirt@juniper.net"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:juniper:junos:23.2:-:*:*:*:*:*:*", "matchCriteriaId": "1A78CC80-E8B1-4CDA-BB35-A61833657FA7", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:23.2:r1:*:*:*:*:*:*", "matchCriteriaId": "4B3B2FE1-C228-46BE-AC76-70C2687050AE", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:23.2:r1-s1:*:*:*:*:*:*", "matchCriteriaId": "F1B16FF0-900F-4AEE-B670-A537139F6909", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:23.2:r1-s2:*:*:*:*:*:*", "matchCriteriaId": "B227E831-30FF-4BE1-B8B2-31829A5610A6", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:23.4:-:*:*:*:*:*:*", "matchCriteriaId": "78481ABC-3620-410D-BC78-334657E0BB75", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:23.4:r1:*:*:*:*:*:*", "matchCriteriaId": "BE8A5BA3-87BD-473A-B229-2AAB2C797005", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:23.4:r1-s1:*:*:*:*:*:*", "matchCriteriaId": "8B74AC3E-8FC9-400A-A176-4F7F21F10756", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:23.4:r2:*:*:*:*:*:*", "matchCriteriaId": "175CCB13-76C0-44A4-A71D-41E22B92EB23", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:24.1:-:*:*:*:*:*:*", "matchCriteriaId": "58C99F21-D87E-48FD-85EF-9A5EF6DE53B7", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:24.1:r1:*:*:*:*:*:*", "matchCriteriaId": "0EA5E5D6-F7B5-46BE-B96D-F64CCEAF08F2", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:23.2:-:*:*:*:*:*:*", "matchCriteriaId": "6DEAA7FD-385F-4221-907E-65ABC16BE4BE", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:23.2:r1:*:*:*:*:*:*", "matchCriteriaId": "DDEC008A-3137-48D1-8ABC-6DB0EFC40E50", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:23.2:r1-s1:*:*:*:*:*:*", "matchCriteriaId": "558D234D-BC50-415F-86D6-8E19D6C3ACE0", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:23.2:r1-s2:*:*:*:*:*:*", "matchCriteriaId": "33F4EEEE-77E9-4973-A770-99E7BA2F05F5", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:23.4:-:*:*:*:*:*:*", "matchCriteriaId": "9D7F0D73-85EE-4A07-B51B-6BF52ECBA75E", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:23.4:r1:*:*:*:*:*:*", "matchCriteriaId": "FE777A1F-9CD9-426E-AF1C-FBE01EB9A4A8", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:23.4:r1-s1:*:*:*:*:*:*", "matchCriteriaId": "7147BA60-30A5-4CED-9AAF-F6BEA0528B89", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:23.4:r2:*:*:*:*:*:*", "matchCriteriaId": "FB82B22F-9005-4EF0-A1E3-4261757783D4", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:24.1:-:*:*:*:*:*:*", "matchCriteriaId": "8E41F858-24E8-4986-BED6-BE5151219DEC", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:24.1:r1:*:*:*:*:*:*", "matchCriteriaId": "EE57490C-2800-4456-8293-B54A255CF348", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A Missing Release of Memory after Effective Lifetime vulnerability in the routing protocol daemon (rpd) Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated attacker controlling an adjacent IS-IS neighbor to send a specific update packet causing a memory leak.\u00a0Continued receipt and processing of these packets will exhaust all available memory, crashing rpd and creating a Denial of Service (DoS) condition.\n\nMemory usage can be monitored through the use of the 'show task memory detail' command. For example:\n\nuser@junos> show task memory detail | match ted-infra\n\u00a0 TED-INFRA-COOKIE \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 25 \u00a0 1072 \u00a0 \u00a0 28 \u00a0 1184 \u00a0 \u00a0 229\n\n\n\nuser@junos> \n\nshow task memory detail | match ted-infra\n\u00a0 TED-INFRA-COOKIE \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 31 \u00a0 1360 \u00a0 \u00a0 34 \u00a0 1472 \u00a0 \u00a0 307\n\nThis issue affects:\n\nJunos OS:\u00a0\n\n * from 23.2 before 23.2R2,\u00a0\n * from 23.4 before 23.4R1-S2, 23.4R2,\u00a0\n * from 24.1 before 24.1R2;\u00a0\n\n\nJunos OS Evolved:\u00a0\n\n * from 23.2 before 23.2R2-EVO,\u00a0\n * from 23.4 before 23.4R1-S2-EVO, 23.4R2-EVO,\u00a0\n * from 24.1 before 24.1R2-EVO.\n\n\nThis issue does not affect Junos OS versions before 23.2R1 or Junos OS Evolved versions before 23.2R1-EVO."}, {"lang": "es", "value": "Una vulnerabilidad de Missing Release of Memory after Effective Lifetime en el demonio del protocolo de enrutamiento (rpd) de Juniper Networks Junos OS y Junos OS Evolved permite a un atacante no autenticado que controla un vecino IS-IS adyacente enviar un paquete de actualizaci\u00f3n espec\u00edfico causando una fuga de memoria. La recepci\u00f3n y el procesamiento continuos de estos paquetes agotar\u00e1n toda la memoria disponible, bloqueando rpd y creando una condici\u00f3n de denegaci\u00f3n de servicio (DoS).\n\nEl uso de la memoria se puede monitorear mediante el uso del comando 'show task memory detail'. Por ejemplo:\n\nuser@junos&gt; show task memory detail | match ted-infra\n&#xa0; TED-INFRA-COOKIE &#xa0; &#xa0; &#xa0; &#xa0; &#xa0; 25 &#xa0; 1072 &#xa0; &#xa0; 28 &#xa0; 1184 &#xa0; &#xa0; 229\n\n\n\nuser@junos&gt; \n\nshow task memory detail | match ted-infra\n&#xa0; TED-INFRA-COOKIE &#xa0; &#xa0; &#xa0; &#xa0; &#xa0; 31 &#xa0; 1360 &#xa0; &#xa0; 34 &#xa0; 1472 &#xa0; &#xa0; 307\n\nEste problema afecta a:\n\nJunos OS:\n\n * desde 23.2 anterior a 23.2R2,\n * desde 23.4 anterior a 23.4R1-S2, 23.4R2,\n * desde 24.1 anterior a 24.1R2;\n\nJunos OS Evolved:\n\n * desde 23.2 anterior a 23.2R2-EVO,\n * desde 23.4 anterior a 23.4R1-S2-EVO, 23.4R2-EVO,\n * desde 24.1 anterior a 24.1R2-EVO.\n\nEste problema no afecta a las versiones de Junos OS anteriores a 23.2R1 ni a las versiones de Junos OS Evolved anteriores a 23.2R1-EVO."}], "id": "CVE-2026-21909", "lastModified": "2026-06-17T10:19:08.240", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "sirt@juniper.net", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "YES", "Recovery": "AUTOMATIC", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "GREEN", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "CONCENTRATED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:Green", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "MODERATE"}, "source": "sirt@juniper.net", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-21909", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-15T20:52:37.531214Z", "version": "2.0.3"}}]}, "published": "2026-01-15T21:16:06.727", "references": [{"source": "sirt@juniper.net", "tags": ["Vendor Advisory"], "url": "https://kb.juniper.net/JSA106008"}, {"source": "sirt@juniper.net", "tags": ["Vendor Advisory"], "url": "https://supportportal.juniper.net/JSA106008"}], "sourceIdentifier": "sirt@juniper.net", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-401"}], "source": "sirt@juniper.net", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T05:58:30.151385+00:00", "value": {"mitigation_remediation": ["Upgrade Junos OS to release 23.2R2 or later on all vulnerable devices.", "Upgrade Junos OS Evolved to release 23.2R2\u2011EVO or later on all vulnerable devices.", "Limit IS\u2011IS adjacencies to trusted peers or remove untrusted adjacencies from routers running affected software.", "Use the 'show task memory detail' command to monitor the rpd process memory usage and take corrective action if memory growth indicates a leak."], "summary": {"action": "Immediate Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "Juniper Networks Junos OS and Junos OS Evolved devices are affected. For Junos OS the issue impacts all releases from 23.2 up to but not including 23.2R2, from 23.4 up to but not including the first release after 23.4R1\u2011S2, and from 24.1 up to but not including 24.1R2. For Junos OS Evolved the affected range mirrors the Junos OS range, with the same release boundaries. Devices running versions earlier than 23.2R1 or 23.2R1\u2011EVO are not affected.", "description_and_impact": "A missing release of memory after effective lifetime vulnerability in the routing protocol daemon (rpd) allows an unauthenticated attacker controlling a neighboring IS\u2011IS node to send a specially crafted update packet, causing a memory leak. Continued receipt of such packets exhausts all available memory, causing the rpd process to crash and resulting in a denial\u2011of\u2011service condition for the router.", "risk_and_exploitability": "The severity is rated at CVSS 7.1 (medium) and the EPSS score is below 1%, indicating a low probability of exploitation in the wild. Nonetheless, the vulnerability is unauthenticated and requires only that an attacker control a neighboring IS\u2011IS node, which is relatively trivial to achieve in many environments. Because the exploit simply involves sending repeated update packets that trigger a memory leak, operators should treat this as a moderate risk until the software is patched. The vulnerability is not listed in the CISA KEV catalog as of the current data."}}}}, "created": "2026-01-16T13:42:47.272392+00:00", "updated": "2026-04-18T06:00:08.508104+00:00", "vendors": ["juniper_networks", "juniper_networks$PRODUCT$junos_os", "juniper_networks$PRODUCT$junos_os_evolved"]}