CVE-2026-21921

CWE-416Use After Free4 documents4 sources
Severity
7.1HIGH
EPSS
0.0%
top 95.44%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedJan 15

Description

A Use After Free vulnerability in the chassis daemon (chassisd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-based attacker authenticated with low privileges to cause a Denial-of-Service (DoS). When telemetry collectors are frequently subscribing and unsubscribing to sensors continuously over a long period of time, telemetry-capable processes like chassisd, rpd or mib2d will crash and restart, which - depending on the process - can cause a complete outage until the system

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L

Affected Packages4 packages

CVEListV5juniper_networks/junos_os_evolved23.223.2R2-S5-EVO+2
CVEListV5juniper_networks/junos_os23.223.2R2-S5+2
NVDjuniper/junos< 22.4+3

🔴Vulnerability Details

2
CVEList
Junos OS and Junos OS Evolved: When telemetry collectors are frequently subscribing and unsubscribing to sensors chassisd or rpd will crash2026-01-15
GHSA
GHSA-fm5x-5pxq-6229: A Use After Free vulnerability in the chassis daemon (chassisd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-based attacker auth2026-01-15

📋Vendor Advisories

1
Juniper
CVE-2026-21921: A Use After Free vulnerability in the chassis daemon (chassisd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-based attacker auth2026-01-15
CVE-2026-21921 (HIGH CVSS 7.1) | A Use After Free vulnerability in t | cvebase.io