---
id: CVE-2026-101959
title: >-
  A Function Call With Incorrect Variable or Reference as Argument vulnerability
  in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS
  Evolved allows an unauthenticated adjacent attacker to cause an rpd crash via
  s…
summary: >-
  A Function Call With Incorrect Variable or Reference as Argument vulnerability
  in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS
  Evolved allows an unauthenticated adjacent attacker to cause an rpd crash via
  s…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-688
published: '2026-10-14'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T21:17:22.137'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-101959'
references:
  - url: 'https://supportportal.juniper.net/JSA112187'
    label: sirt@juniper.net
tags:
  - nvd
ingestedAt: '2026-10-14T18:47:39.301Z'
---

## Overview

A Function Call With Incorrect Variable or Reference as Argument vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause an rpd crash via specifically malformed LSP-ping.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.