A Buffer Over-read vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).

When an affected device receives a BGP update with a set of specific optional transitive attributes over an established peering session, rpd will crash and restart when attempting to advertise the received information to another peer.
This issue can only happen if one or both of the BGP peers of the receiving session are non-4-byte-AS capable as determined from the advertised capabilities during BGP session establishment. Junos OS and Junos OS Evolved default behavior is 4-byte-AS capable unless this has been specifically disabled by configuring:

[ protocols bgp ... disable-4byte-as ]

Established BGP sessions can be checked by executing:

show bgp neighbor <IP address> | match "4 byte AS"

This issue affects:

Junos OS: 

• all versions before 22.4R3-S8,
• 23.2 versions before 23.2R2-S5,
• 23.4 versions before 23.4R2-S6,
• 24.2 versions before 24.2R2-S2,
• 24.4 versions before 24.4R2;

Junos OS Evolved: 

• all versions before 22.4R3-S8-EVO,
• 23.2 versions before 23.2R2-S5-EVO,
• 23.4 versions before 23.4R2-S6-EVO,
• 24.2 versions before 24.2R2-S2-EVO,
• 24.4 versions before 24.4R2-EVO.

To be exposed to this issue at least two BGP peers needs to be configured via:

[ protocols bgp ... neighbor ... ]

Juniper SIRT is not aware of any malicious exploitation of this vulnerability.

This issue was discovered during external security research.

The following software releases have been updated to resolve this specific issue:
Junos OS Evolved: 22.4R3-S8-EVO, 23.2R2-S5-EVO, 23.4R2-S6-EVO, 24.2R2-S2-EVO, 24.4R2-EVO, 25.2R1-EVO, and all subsequent releases;
Junos OS: 22.4R3-S8, 23.2R2-S5, 23.4R2-S6, 24.2R2-S2, 24.4R2, 25.2R1, and all subsequent releases.

This issue is being tracked as 1878812 which is visible on the Customer Support website.

Note: Juniper SIRT's policy is not to evaluate releases which are beyond End of Engineering (EOE) or End of Life (EOL).

2026-01-14: Initial Publication

• KB16613: Overview of the Juniper Networks SIRT Quarterly Security Bulletin Publication Process [juniper.net]
• KB16765: In which releases are vulnerabilities fixed? [juniper.net]
• KB16446: Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories [juniper.net]
• Report a Security Vulnerability - How to Contact the Juniper Networks Security Incident Response Team

Juniper SIRT would like to acknowledge and thank Craig Dods from Meta’s Infrastructure Security Engineering team for responsibly reporting this vulnerability.