CVE-2026-21909

CWE-401 — Memory Leak4 documents4 sources
Severity
7.1HIGH
EPSS
0.0%
top 99.34%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Juniper Networks Junos OSJuniper Networks Junos OS EvolvedJuniper Junos+1 more
Timeline
PublishedJan 15

Description

A Missing Release of Memory after Effective Lifetime vulnerability in the routing protocol daemon (rpd) Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated attacker controlling an adjacent IS-IS neighbor to send a specific update packet causing a memory leak. Continued receipt and processing of these packets will exhaust all available memory, crashing rpd and creating a Denial of Service (DoS) condition. Memory usage can be monitored through the use of the 'show task memory…

CVSS vector

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L

Affected Packages4 packages

▶CVEListV5juniper_networks/junos_os_evolved23.2 — 23.2R2-EVO+2
▶NVDjuniper/junos_os_evolved23.2, 23.4, 24.1+2
▶CVEListV5juniper_networks/junos_os23.2 — 23.2R2+2
▶NVDjuniper/junos23.2, 23.4, 24.1+2

🔴Vulnerability Details

2
GHSA
GHSA-cf3w-5gm7-wvp9: A Missing Release of Memory after Effective Lifetime vulnerability in the routing protocol daemon (rpd) Juniper Networks Junos OS and Junos OS Evolved↗2026-01-15
▶
CVEList
Junos OS and Junos OS Evolved: Receipt of specific IS-IS update packet causes memory leak leading to RPD crash↗2026-01-15
▶

📋Vendor Advisories

1
Juniper
CVE-2026-21909: A Missing Release of Memory after Effective Lifetime vulnerability in the routing protocol daemon (rpd) Juniper Networks Junos OS and Junos OS Evolved↗2026-01-15
▶
CVE-2026-21909 (HIGH CVSS 7.1) | A Missing Release of Memory after E | cvebase.io