CVE-2026-21921 Use after free in Junos OS
Authenticated attackers can cause a denial of service in Junos OS by triggering a use-after-free in chassisd via frequent telemetry subscriptions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-21921?
CVE-2026-21921 is a high-severity use after free vulnerability in Juniper Junos, published on 15 Jan 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A Use After Free vulnerability in the chassis daemon (chassisd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-based attacker authenticated with low privileges to cause a Denial-of-Service (DoS).
When telemetry collectors are frequently subscribing and unsubscribing to sensors continuously over a long period of time, telemetry-capable processes like chassisd, rpd or mib2d will crash and restart, which - depending on the process - can cause a complete outage until the system has recovered.
This issue affects:
Junos OS:
* all versions before 22.4R3-S8, * 23.2 versions before 23.2R2-S5, * 23.4 versions before 23.4R2;
Junos OS Evolved:
* all versions before 22.4R3-S8-EVO, * 23.2 versions before 23.2R2-S5-EVO, * 23.4 versions before 23.4R2-EVO.
Weakness: CWE-416
Which versions are affected by CVE-2026-21921?
It affects 2 products.
Products include Juniper Junos, Juniper Junos Os Evolved.
How do I fix CVE-2026-21921?
No fix has been published for CVE-2026-21921 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-21921 being exploited?
There is no known exploitation of CVE-2026-21921 in the wild and no public exploit code.
Other vulnerabilities in Juniper Junos
- CVE-2023-36845 Juniper Junos OS EX Series and SRX Series PHP External Variable Modification
- CVE-2020-1631 Juniper Junos OS Path Traversal
- CVE-2025-21590 Juniper Junos OS Improper Isolation or Compartmentalization
- CVE-2023-36851 Juniper Junos OS SRX Series Missing Authentication for Critical Function
- CVE-2023-36844 Juniper Junos OS EX Series PHP External Variable Modification
Sources
Also known as GHSA-fm5x-5pxq-6229.