A Missing Release of Memory after Effective Lifetime vulnerability in the routing protocol daemon (rpd) Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated attacker controlling an adjacent IS-IS neighbor to send a specific update packet causing a memory leak. Continued receipt and processing of these packets will exhaust all available memory, crashing rpd and creating a Denial of Service (DoS) condition.
Memory usage can be monitored through the use of the 'show task memory detail' command. For example:
user@junos> show task memory detail | match ted-infra
TED-INFRA-COOKIE 25 1072 28 1184 229
user@junos>
show task memory detail | match ted-infra
TED-INFRA-COOKIE 31 1360 34 1472 307
This issue affects:
Junos OS:
* from 23.2 before 23.2R2,
* from 23.4 before 23.4R1-S2, 23.4R2,
* from 24.1 before 24.1R2;
Junos OS Evolved:
* from 23.2 before 23.2R2-EVO,
* from 23.4 before 23.4R1-S2-EVO, 23.4R2-EVO,
* from 24.1 before 24.1R2-EVO.
This issue does not affect Junos OS versions before 23.2R1 or Junos OS Evolved versions before 23.2R1-EVO.
References
| Link | Resource |
|---|---|
| https://kb.juniper.net/JSA106008 | Vendor Advisory |
| https://supportportal.juniper.net/JSA106008 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
23 Jan 2026, 19:40
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:juniper:junos:23.4:-:*:*:*:*:*:* cpe:2.3:o:juniper:junos_os_evolved:24.1:r1:*:*:*:*:*:* cpe:2.3:o:juniper:junos:24.1:r1:*:*:*:*:*:* cpe:2.3:o:juniper:junos_os_evolved:23.4:r2:*:*:*:*:*:* cpe:2.3:o:juniper:junos:23.4:r1:*:*:*:*:*:* cpe:2.3:o:juniper:junos:23.2:r1-s2:*:*:*:*:*:* cpe:2.3:o:juniper:junos:24.1:-:*:*:*:*:*:* cpe:2.3:o:juniper:junos_os_evolved:23.2:r1-s2:*:*:*:*:*:* cpe:2.3:o:juniper:junos:23.4:r2:*:*:*:*:*:* cpe:2.3:o:juniper:junos_os_evolved:23.2:r1-s1:*:*:*:*:*:* cpe:2.3:o:juniper:junos_os_evolved:23.2:-:*:*:*:*:*:* cpe:2.3:o:juniper:junos_os_evolved:23.4:r1:*:*:*:*:*:* cpe:2.3:o:juniper:junos_os_evolved:23.2:r1:*:*:*:*:*:* cpe:2.3:o:juniper:junos_os_evolved:24.1:-:*:*:*:*:*:* cpe:2.3:o:juniper:junos:23.4:r1-s1:*:*:*:*:*:* cpe:2.3:o:juniper:junos:23.2:r1:*:*:*:*:*:* cpe:2.3:o:juniper:junos_os_evolved:23.4:r1-s1:*:*:*:*:*:* cpe:2.3:o:juniper:junos:23.2:-:*:*:*:*:*:* cpe:2.3:o:juniper:junos_os_evolved:23.4:-:*:*:*:*:*:* cpe:2.3:o:juniper:junos:23.2:r1-s1:*:*:*:*:*:* |
|
| References | () https://kb.juniper.net/JSA106008 - Vendor Advisory | |
| References | () https://supportportal.juniper.net/JSA106008 - Vendor Advisory | |
| First Time |
Juniper junos
Juniper Juniper junos Os Evolved |
15 Jan 2026, 21:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-01-15 21:16
Updated : 2026-01-23 19:40
NVD link : CVE-2026-21909
Mitre link : CVE-2026-21909
CVE.ORG link : CVE-2026-21909
JSON object : View
Products Affected
juniper
- junos_os_evolved
- junos
CWE
CWE-401
Missing Release of Memory after Effective Lifetime