Product:
Junos OS
Summary
A Missing Release of Memory after Effective Lifetime vulnerability in the routing protocol daemon allows an unauthenticated attacker controlling an adjacent IS-IS neighbor to send a specific update packet causing a memory leak. Continued receipt and processing of these packets will exhaust all available memory, crashing the daemon and creating a Denial of Service condition. This issue affects specific versions of Junos OS and Junos OS Evolved.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.1 | CVE-2026-21909 |
Exploitation
An attacker on an adjacent network can exploit this vulnerability by sending specially crafted update packets to the routing protocol daemon. This will lead to a memory leak, and if the packets are sent continuously, it will eventually exhaust the available memory, resulting in a crash of the daemon and a Denial of Service condition.
Affected Products
- Junos OS: from 23.2 before 23.2R2, from 23.4 before 23.4R1-S2, 23.4R2, from 24.1 before 24.1R2
- Junos OS Evolved: from 23.2 before 23.2R2-EVO, from 23.4 before 23.4R1-S2-EVO, 23.4R2-EVO, from 24.1 before 24.1R2-EVO
Mitigation
To mitigate this vulnerability, users should upgrade to the latest versions of Junos OS and Junos OS Evolved that are not affected by this issue. Regular monitoring of memory usage can help identify potential exploitation attempts.