Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.0

Juniper Networks Junos OS and Junos OS Evolved: DoS when BGP connections fail

CVE-2025-52958 · published 1 year ago
Summary

A bug in Juniper Networks Junos OS and Junos OS Evolved can cause a device to crash and stop working if it experiences repeated BGP connection failures. This can happen when an attacker is trying to connect to the device and the connection fails. If this happens, you may need to restart the device to restore service. Affected devices include all versions of Junos OS before 22.2R3-S6 and certain versions of Junos OS Evolved. Patch your device to the latest available version to prevent this issue.

What to do
  • Update juniper junos to version 22.2 or later.
  • Update juniper junos_os_evolved to version 22.2 or later.
Affected software
VendorProductAffected versions
juniper junos < 22.2
22.2
22.4
23.2
23.4
24.2
cpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:*
juniper junos_os_evolved < 22.2
22.2
22.4
23.2
23.4
24.2
cpe:2.3:o:juniper:junos_os_evolved:*:*:*:*:*:*:*:*
Original advisory text
A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated attacker to cause a Denial of Service ...
A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated attacker to cause a Denial of Service (DoS).On all Junos OS and Junos OS Evolved devices, when route validation is enabled, a rare condition during BGP initial session establishment can lead to an rpd crash and restart. This occurs specifically when the connection request fails during error-handling scenario.

Continued session establishment failures leads to a sustained DoS condition. 

This issue affects Junos OS:

* All versions before 22.2R3-S6,
* from 22.4 before 22.4R3-S6,
* from 23.2 before 23.2R2-S3,
* from 23.4 before 23.4R2-S4,
* from 24.2 before 24.2R2;



Junos OS Evolved:
* All versions before 22.2R3-S6-EVO,
* from 22.4 before 22.4R3-S6-EVO,
* from 23.2 before 23.2R2-S3-EVO,
* from 23.4 before 23.4R2-S4-EVO,
* from 24.2 before 24.2R2-EVO.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.0 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-617Reachable Assertion
Timeline
Published11 Jul 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-52958 · NVD
Track software like this
Free during beta