Junos OS dot1xd Use After Free (23.2R2S1..S5) DoS/Arbitrary Code
CVE-2026-21908 Published on January 15, 2026
Junos OS and Junos OS Evolved: Use after free vulnerability In 802.1X authentication daemon can cause crash of the dot1xd process
A Use After Free vulnerability was identified in the 802.1X authentication daemon (dot1xd) of Juniper Networks Junos OS and Junos OS Evolved that could allow an authenticated, network-adjacent attacker flapping a port to crash the dot1xd process, leading to a Denial of Service (DoS), or potentially execute arbitrary code within the context of the process running as root.
The issue is specific to the processing of a change in authorization (CoA) when a port bounce occurs. A pointer is freed but was then referenced later in the same code path. Successful exploitation is outside the attacker's direct control due to the specific timing of the two events required to execute the vulnerable code path.
This issue affects systems with 802.1X authentication port-based network access control (PNAC) enabled.
This issue affects:
Junos OS:
* from 23.2R2-S1 before 23.2R2-S5,
* from 23.4R2 before 23.4R2-S6,
* from 24.2 before 24.2R2-S3,
* from 24.4 before 24.4R2-S1,
* from 25.2 before 25.2R1-S2, 25.2R2;
Junos OS Evolved:
* from 23.2R2-S1 before 23.2R2-S5-EVO,
* from 23.4R2 before 23.4R2-S6-EVO,
* from 24.2 before 24.2R2-S3-EVO,
* from 24.4 before 24.4R2-S1-EVO,
* from 25.2 before 25.2R1-S2-EVO, 25.2R2-EVO.
Vulnerability Analysis
Weakness Type
What is a Dangling pointer Vulnerability?
Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.
CVE-2026-21908 has been classified to as a Dangling pointer vulnerability or weakness.
Products Associated with CVE-2026-21908
stack.watch emails you whenever new vulnerabilities are published in Juniper Networks Junos or Juniper Networks Junos Os Evolved. Just hit a watch button to start following.
Affected Versions
Juniper Networks Junos OS:- Version 23.2R2-S1 and below 23.2R2-S5 is affected.
- Version 23.4R2 and below 23.4R2-S6 is affected.
- Version 24.2 and below 24.2R2-S3 is affected.
- Version 24.4 and below 24.4R2-S1 is affected.
- Version 25.2 and below 25.2R1-S2, 25.2R2 is affected.
- Version 23.2R2-S1 and below 23.2R2-S5-EVO is affected.
- Version 23.4R2 and below 23.4R2-S6-EVO is affected.
- Version 24.2 and below 24.2R2-S3-EVO is affected.
- Version 24.4 and below 24.4R2-S1-EVO is affected.
- Version 25.2 and below 25.2R1-S2-EVO, 25.2R2-EVO is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.