CVE-2026-21921

Summary

A Use After Free vulnerability in the chassis daemon (chassisd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-based attacker authenticated with low privileges to cause a Denial-of-Service (DoS).

When telemetry collectors are frequently subscribing and unsubscribing to sensors continuously over a long period of time, telemetry-capable processes like chassisd, rpd or mib2d will crash and restart, which - depending on the process - can cause a complete outage until the system has recovered.

This issue affects:

 Junos OS: 

  • all versions before 22.4R3-S8,
  • 23.2 versions before 23.2R2-S5,
  • 23.4 versions before 23.4R2;

Junos OS Evolved:

  • all versions before 22.4R3-S8-EVO,
  • 23.2 versions before 23.2R2-S5-EVO,
  • 23.4 versions before 23.4R2-EVO.

Affected Software

VendorProductVersion RangeStatus
Juniper NetworksJunos OS0 < 22.4R3-S8affected
Juniper NetworksJunos OS23.2 < 23.2R2-S5affected
Juniper NetworksJunos OS23.4 < 23.4R2affected
Juniper NetworksJunos OS Evolved0 < 22.4R3-S8-EVOaffected
Juniper NetworksJunos OS Evolved23.2 < 23.2R2-S5-EVOaffected
Juniper NetworksJunos OS Evolved23.4 < 23.4R2-EVOaffected

Weaknesses

  • CWE-416: CWE-416 Use After Free

Workarounds

There are no known workarounds for this issue.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References