CVE-2026-101941 is a High (CVSS 7.5) NULL pointer dereference in the routing protocol daemon of Junos OS and Junos OS Evolved. A configured BGP neighbor can cause a denial of service with a route update when a routing policy resolution map and policy event tracing are configured. Check JSA112187 for fixes.
What's affected
The weakness is CWE-476 (NULL pointer dereference). The record says a configured BGP neighbor can trigger a denial of service through a BGP route update, when specific routing policy resolution-map and policy event-tracing configuration is enabled. Junos OS and Junos OS Evolved are both named.
Juniper bulletin JSA112187 is the record's only reference. It also covers CVE-2026-101940, CVE-2026-101942 and CVE-2026-101943. We could not load the Juniper support portal, so we could not confirm affected or fixed releases. Use the bulletin's tables for that.
The vector is network, low complexity, no privileges and no user interaction, with high impact on availability. Note the contrast with the first CVE in the bulletin: this one depends on a different configuration. A device can be exposed to one entry in the bulletin and not another, so check each against your configuration.
How to check if you're exposed
Get the version with show version and compare it to JSA112187.
Next check the configuration for the two conditions in the record. A resolution map is part of routing policy for resolving routes, and policy event tracing is a tracing option. Search for both.
show configuration | display set | match resolution-map
show configuration | display set | match trace
The second command will match many tracing lines, so read the results for policy related tracing. If you have a resolution map and policy tracing, you meet the described condition.
Then confirm which BGP neighbors you have, since the sender must be one of them.
show bgp neighbor | match "Peer:"
The free in-browser dependency scan at gold.safeguard.sh/scan can match a lockfile or manifest against known CVEs without installing anything. The Gold directory page for each CVE lists affected packages and fixes as they are published.
What to do now
- Read JSA112187 and find the fixed release for your platform.
- Find devices with both a routing policy resolution map and policy event tracing configured.
- Upgrade to a fixed release in your next maintenance window.
- If you can, turn off policy event tracing on affected devices until the upgrade, since the record says the trigger needs that configuration. Confirm with Juniper guidance.
- Limit BGP neighbors to known, authenticated peers.
Why it matters
Diagnostic features such as tracing add code paths that run in the middle of normal route processing. A bug in one of them can bring down the whole daemon. This record says the daemon crashes when a route update arrives and both features are on.
The effect is loss of routing for as long as the daemon is down or restarting. The sources we reviewed do not report exploitation, and the record does not flag the CVE as known exploited.
Quick check
Is this the same bug as CVE-2026-101940?
No. It is in the same bulletin and the same daemon, but it depends on a different configuration: a resolution map with policy event tracing.
Is turning off tracing a fix?
It removes one of the two conditions in the record, but it is not a fix. Upgrade as the bulletin directs.
Sources
Last reviewed: 18 October 2026.
