CVE-2026-21921: Juniper Networks Junos OS DoS Vulnerability

CVE-2026-21921 Overview

A Use After Free vulnerability has been discovered in the chassis daemon (chassisd) of Juniper Networks Junos OS and Junos OS Evolved. This vulnerability allows a network-based attacker with low-level authentication to cause a Denial-of-Service (DoS) condition on affected devices.

The vulnerability is triggered when telemetry collectors frequently subscribe and unsubscribe to sensors continuously over an extended period. This activity causes telemetry-capable processes such as chassisd, rpd, or mib2d to crash and restart. Depending on the affected process, this can result in a complete network outage until the system recovers.

Critical Impact

Authenticated attackers can crash critical network infrastructure daemons, potentially causing complete network outages affecting enterprise routing and switching operations.

Affected Products

• Junos OS: all versions before 22.4R3-S8
• Junos OS: 23.2 versions before 23.2R2-S5
• Junos OS: 23.4 versions before 23.4R2
• Junos OS Evolved: all versions before 22.4R3-S8-EVO
• Junos OS Evolved: 23.2 versions before 23.2R2-S5-EVO
• Junos OS Evolved: 23.4 versions before 23.4R2-EVO

Discovery Timeline

• 2026-01-15 - CVE-2026-21921 published to NVD
• 2026-01-16 - Last updated in NVD database

Technical Details for CVE-2026-21921

Vulnerability Analysis

This Use After Free (CWE-416) vulnerability resides in the chassis daemon (chassisd) of Juniper Networks Junos OS and Junos OS Evolved. The flaw occurs during the handling of telemetry subscription operations, where memory management errors lead to the use of previously freed memory regions.

When telemetry collectors engage in rapid subscription and unsubscription cycles to sensors, the affected processes fail to properly manage memory lifecycle events. This results in accessing memory that has already been deallocated, leading to process crashes. The vulnerability specifically impacts telemetry-capable daemons including chassisd (chassis daemon), rpd (routing protocol daemon), and mib2d (SNMP MIB daemon).

The network-based attack vector means that remote authenticated attackers can exploit this vulnerability without physical access to the device. While low-privilege authentication is required, the impact is significant as crashing core system daemons can lead to complete device unavailability.

Root Cause

The root cause is improper memory handling in the telemetry subscription management code path. When telemetry collectors rapidly subscribe and unsubscribe to sensors, the daemon fails to properly track memory allocation states, resulting in references to freed memory objects. This Use After Free condition (CWE-416) occurs because the code attempts to access memory regions after they have been deallocated by the unsubscription operation.

Attack Vector

The attack leverages network access with low-privilege authentication to trigger the vulnerability. An attacker would need to:

1. Authenticate to the target Juniper device with minimal privileges
2. Initiate rapid subscription and unsubscription cycles to telemetry sensors
3. Maintain this pattern over time to trigger the memory corruption condition
4. Cause the chassisd, rpd, or mib2d processes to crash

The attack exploits the telemetry subscription handling mechanism by creating race conditions in memory management. The continuous subscribe/unsubscribe pattern exhausts proper memory tracking, eventually leading to a Use After Free condition that crashes the daemon.

See the Juniper Security Advisory JSA106021 for complete technical details.

Detection Methods for CVE-2026-21921

Indicators of Compromise

• Unexpected crashes or restarts of chassisd, rpd, or mib2d processes
• System logs showing repeated daemon restart events with memory-related errors
• Unusual patterns of telemetry subscription and unsubscription activity
• Core dumps indicating Use After Free conditions in telemetry-handling code paths

Detection Strategies

• Monitor system logs for chassisd, rpd, or mib2d process crash events and unexpected restarts
• Implement alerting for high-frequency telemetry subscription/unsubscription patterns
• Review authentication logs for suspicious low-privilege account activity targeting telemetry interfaces
• Analyze core dumps for memory corruption signatures consistent with Use After Free conditions

Monitoring Recommendations

• Enable enhanced logging for telemetry operations on Junos OS devices
• Configure SNMP traps or syslog forwarding for critical daemon crash events
• Establish baseline metrics for normal telemetry subscription activity to identify anomalies
• Implement real-time monitoring of process health for critical network infrastructure daemons

How to Mitigate CVE-2026-21921

Immediate Actions Required

• Upgrade Junos OS to version 22.4R3-S8, 23.2R2-S5, or 23.4R2 or later
• Upgrade Junos OS Evolved to version 22.4R3-S8-EVO, 23.2R2-S5-EVO, or 23.4R2-EVO or later
• Review and restrict access to telemetry subscription interfaces to trusted administrators only
• Implement network segmentation to limit exposure of management interfaces

Patch Information

Juniper Networks has released security patches addressing this vulnerability across multiple Junos OS release trains:

For detailed patch information and download links, refer to the Juniper Security Advisory JSA106021.

Workarounds

• Limit telemetry collector access to only trusted, authorized systems
• Implement rate limiting on telemetry subscription operations where possible
• Restrict network access to device management interfaces using firewall rules or ACLs
• Monitor and alert on high-frequency telemetry subscription activity as an interim detection measure

# Example: Restrict management access via firewall filter
set firewall family inet filter MGMT-ACCESS term ALLOW-TRUSTED from source-address 10.0.0.0/24
set firewall family inet filter MGMT-ACCESS term ALLOW-TRUSTED then accept
set firewall family inet filter MGMT-ACCESS term DENY-ALL then reject
set interfaces lo0 unit 0 family inet filter input MGMT-ACCESS