An Improper Handling of Exceptional Conditions vulnerability in Berkeley Packet Filter (BPF) processing of Juniper Networks Junos OS allows an attacker, in rare cases, sending specific, unknown traffic patterns to cause the FPC and system to crash and restart.

BPF provides a raw interface to data link layers in a protocol-independent fashion. Internally within the Junos kernel, due to a rare timing issue (race condition), when a BPF instance is cloned, the newly created interface causes an internal structure leakage, leading to a system crash. The precise content and timing of the traffic patterns is indeterminate, but has been seen in a lab environment multiple times.

This issue is more likely to occur when packet capturing is enabled. See required configuration below.

This issue affects Junos OS: 

• all versions before 21.2R3-S9, 
• from 21.4 before 21.4R3-S10, 
• from 22.2 before 22.2R3-S6, 
• from 22.4 before 22.4R3-S7, 
• from 23.2 before 23.2R2-S3, 
• from 23.4 before 23.4R2-S3, 
• from 24.2 before 24.2R1-S1, 24.2R2.

BPF is used by applications such as 'tcpdump', enabled in Junos via packet-capture sampling:

[forwarding-options packet-capture file ...]

[firewall filter <name> term <name> then sample]

[interfaces <interface> unit <n> family inet filter input <name>]
[interfaces <interface> unit <n> family inet filter output <name>]

or via the 'monitor traffic' command. For example:

user@junos> monitor traffic interface <name> 

Juniper SIRT is not aware of any malicious exploitation of this vulnerability.

This issue was found during internal product security testing or research.

The following software releases have been updated to resolve this specific issue: 21.2R3-S9, 21.4R3-S10, 22.2R3-S6, 22.4R3-S7, 23.2R2-S3, 23.4R2-S3, 24.2R1-S1, 24.2R2, 24.4R1, and all subsequent releases.

This issue is being tracked as 1819102 which is visible on the Customer Support website.

Note: Juniper SIRT's policy is not to evaluate releases which are beyond End of Engineering (EOE) or End of Life (EOL).

Avoid execution of the 'monitor traffic interface' command on production systems.

2025-07-09: Initial Publication
2025-07-18: Corrected vulnerable 'monitor' command from 'monitor interface' to 'monitor traffic'
2025-07-23: Added workaround of avoiding the execution of the 'monitor traffic' command

• KB16613: Overview of the Juniper Networks SIRT Quarterly Security Bulletin Publication Process [juniper.net]
• KB16765: In which releases are vulnerabilities fixed? [juniper.net]
• KB16446: Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories [juniper.net]
• Report a Security Vulnerability - How to Contact the Juniper Networks Security Incident Response Team
• https://www.cve.org/CVERecord?id=CVE-2025-52948