CVE-2026-21908
Severity CVSS v4.0:
HIGH
Type:
CWE-416
Use After Free
Publication date:
15/01/2026
Last modified:
15/01/2026
Description
A Use After Free vulnerability was identified in the 802.1X authentication daemon (dot1xd) of Juniper Networks Junos OS and Junos OS Evolved that could allow an authenticated, network-adjacent attacker flapping a port to crash the dot1xd process, leading to a Denial of Service (DoS), or potentially execute arbitrary code within the context of the process running as root.<br />
<br />
The issue is specific to the processing of a change in authorization (CoA) when a port bounce occurs. A pointer is freed but was then referenced later in the same code path. Successful exploitation is outside the attacker&#39;s direct control due to the specific timing of the two events required to execute the vulnerable code path.<br />
<br />
This issue affects systems with 802.1X authentication port-based network access control (PNAC) enabled.<br />
This issue affects:<br />
<br />
Junos OS: <br />
<br />
<br />
<br />
* from 23.2R2-S1 before 23.2R2-S5, <br />
* from 23.4R2 before 23.4R2-S6, <br />
* from 24.2 before 24.2R2-S3, <br />
* from 24.4 before 24.4R2-S1, <br />
* from 25.2 before 25.2R1-S2, 25.2R2; <br />
<br />
<br />
<br />
<br />
Junos OS Evolved: <br />
<br />
<br />
<br />
* from 23.2R2-S1 before 23.2R2-S5-EVO, <br />
* from 23.4R2 before 23.4R2-S6-EVO, <br />
* from 24.2 before 24.2R2-S3-EVO, <br />
* from 24.4 before 24.4R2-S1-EVO, <br />
* from 25.2 before 25.2R1-S2-EVO, 25.2R2-EVO.
Impact
Base Score 4.0
7.50
Severity 4.0
HIGH
Base Score 3.x
7.10
Severity 3.x
HIGH