Alert Type

SRN - Software Release Notification
Low/Notificationsoftware release notification
Low/NotificationSoftware Release Notification

Product Affected

All platforms running Junos version 24.4 software

Alert Description

Junos Software Service Release version 24.4R2-S5 is now available for download from the Junos software download site

Download Junos Software Service Release:

  1. Go to Junos Platforms - Download Software page
  2. Input your product in the "Find a Product" search box
  3. From the Type/OS drop-down menu, select Junos SR
  4. From the Version drop-down menu, select your version
  5. Click the Software tab
  6. Select the Install Package as need and follow the prompts

NOTE: Starting on August 30th, 2024, we include PR's severity with each entry. See KB86335 [juniper.net] for the definition of PR's Severity

 

Junos Selective Update (JSU) feasible

Not applicable

Call to Action

For your review

Solution

Junos Software service Release version 24.4R2-S5 is now available.

The full list of fixed and known issues is available in the attachment.

24.4R2-S5 - List of Fixed Issues

PR NumberCategory: Junos SDK PRs specific to the Services SDK
1951698
Critical		A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in the SDK service process of Juniper Networks Junos OS allows an unauthenticated network attacker to cause a denial of service or compromise the Routing Engine by sending specific packets when the SDK service and a JDAF routing instance are enabled. Please refer to https://supportportal.juniper.net/JSA112188 [juniper.net] for more information.
PR NumberCategory: SRX Fleming L2NG platform support
1911533
Minor		On SRX1600 switching mode, table full error message displayed even the L2 table is not full
PR NumberCategory: SRX Fleming Platforms related issues
1916697
Minor		MAC limit Count show 65k in srx1600, but it stops learning at 28k.
PR NumberCategory: SRX Fleming Broadcom TD3/SDK, datapath related issue
1943275
Critical		On SRX1600, SRX2300 and SRX4300 platforms, upon configuring "set protocols l2-learning global-mode switching" where 1G SFP is used on 10G port the port goes down after sometime causing traffic drop. This traffic drop is only subjected to the port where the configuration is applied, thus the other ports remains unaffected.
PR NumberCategory: Fabric for LC1300 and SIB3
1964102
Major		On Junos OS Evolved PTX10004 and PTX10008 platforms with LC1301 line cards and SF5 fabric, fabric link faults need to be reported as major alarms. Link faults can occur during system operation and result in reduced fabric capacity with partial impact. This enhancement introduces the new alarm "One or more PFE pairs operating with less than acceptable fabric capacity" to indicate reduced fabric capacity conditions.
PR NumberCategory: "agentd" software daemon
1954177
Major		An Use of Externally-Controlled Format String vulnerability in the gRPC daemon of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause telemetry-service disruption, information disclosure, or potential root-level code execution via a crafted message to the gNMI service. Please refer to https://supportportal.juniper.net/JSA112250 [juniper.net] for more information.
1954178
Critical		A Reachable Assertion vulnerability in the na-grpcd process of Juniper Networks Junos OS and Junos EVO allows a remote unauthenticated attacker to cause a denial of service via a gRPC telemetry subscription request. Please refer to https://supportportal.juniper.net/JSA112250 [juniper.net] for more information.
1954180
Critical		A NULL Pointer Dereference vulnerability in the na-grpcd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated attacker with access to the chassis-internal network to cause a denial of service via a network message. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: Application Quality of Experience
PR NumberCategory: BBE Layer-2 Bitstream Access
1941118
Major		On Junos MX Broadband Edge (BBE) platforms where Subscriber access management service Layer-2 Bitstream Access (L2BSA) solution is deployed, when "inner-vlan-id-swap-ranges" is modified in the presence of active L2BSA subscribers, free inner-vlan-id count is not calculated correctly, hence subsequent L2BSA login attempts fail and subscribers move to pending state.
PR NumberCategory: Bi Directional Forwarding Detection (BFD)
1958106
Critical		A Reachable Assertion vulnerability in the bfdd daemon of Juniper Networks Junos OS and Junos OS Evolved platforms allows an unauthenticated adjacent attacker to cause a denial of service by restarting the daemon via crafted BFD session traffic. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: Border Gateway Protocol
1952192
Critical		A Stack-based Buffer Overflow vulnerability in the BGP routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP flowspec peer to cause routing-engine compromise or a routing-daemon denial of service via flowspec route re-advertisement when BGP update-threading is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1952197
Critical		A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP peering session to cause a denial of service by sending a crafted BGP route attribute, which is processed while a BGP RIB streaming telemetry subscription is active. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1952737
Critical		A Numeric Truncation Error vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker to cause a denial of service via a BGP Prefix-SID route advertisement that is subsequently re-advertised. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1953061
Critical		An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an eBGP peer which has not negotiated four-octet-AS capability sending a specifically malformed BGP update to cause a Denial-of-Service (DoS). Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1953065
Critical		A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated remote BGP neighbor to cause a denial of service via a VPN-flowspec BGP update if it is readvertised and BMP post-policy RIB-out monitoring is configured. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1953085
Critical		An Improper Validation of Consistency within Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP ISO-VPN peer to cause an rpd crash by sending a specific ISO-VPN update which is then processed by BMP route monitoring or NSR. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1953394
Critical		An Improper Initialization vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote BGP peer to cause an rpd crash via an LLGR-stale route update readvertised to a configured non-LLGR peer group. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1953397
Critical		A Function Call With Incorrect Variable or Reference as Argument vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause an rpd crash via specifically malformed LSP-ping. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1953399
Major		An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS Evolved on QFX5240, QFX5241 and QFX5250 configured for BGP global-load-balancing and more than 128 ecmp next-hops allows an attacker to cause an rpd crash. Please refer to https://supportportal.juniper.net/JSA112250 [juniper.net] for more information.
1953950
Critical		A NULL Pointer Dereference vulnerability in the routing-policy nexthop-ECMP matcher of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP peer to cause a routing-daemon denial of service via a specific BGP packet received while a nexthop-ecmp qualifier is attached to a BGP import policy. Refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1953962
Critical		A NULL Pointer Dereference vulnerability in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated configured BGP peer to cause a denial of service via a BGP UPDATE when ISO-VPN and egress-protection configuration is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954000
Critical		An Improper Input Validation vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker to cause a denial of service via a crafted BGP EVPN update message. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954487
Major		A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-adjacent BGP peer to cause a denial of service when labeled-unicast aggregate-label is configured. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954857
Critical		A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote configured BGP peer to cause an rpd crash or, on Junos OS, remote code-execution via sending a flow-spec update selected for re-advertisement. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954860
Critical		An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP-LS peer to cause heap data disclosure via a malformed UPDATE sent over a session with the traffic-engineering address family enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956236
Critical		An Improper Control of a Resource Through its Lifetime vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent eBGP peer to cause a routing-daemon crash via a BGP route update when RIB sharding is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: BGP BMP Software
1952604
Critical		A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated BGP peer to cause a denial of service and potential root-level command execution via crafted BGP route updates when the BGP Monitoring Protocol (BMP) is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1952739
Critical		A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured external BGP neighbor to execute arbitrary commands with root privileges via BMP route monitoring. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: BBE Remote Access Server
1954232
Critical		A Stack-based Buffer Overflow vulnerability in the authd process of Juniper Networks Junos OS allows an attacker able to influence a configured RADIUS server to cause authd to crash or execute code with root privileges via a malicious RADIUS response. Please refer to https://supportportal.juniper.net/JSA112188 [juniper.net] for more information.
PR NumberCategory: QFX Access Control related
1955815
Major		A Stack-based Buffer Overflow vulnerability in the dot1x daemon of Juniper Networks Junos OS devices operating as Junos Fusion Aggregation Devices allows an adjacent attacker acting as the configured ICCP peer to cause a denial of service and potentially execute code as root via. The issue is triggered when dot1x synchronization is enabled for the required Fusion satellite topology. Please refer to https://supportportal.juniper.net/JSA112188 [juniper.net] for more information.
1956093
Critical		A Heap-based Buffer Overflow vulnerability in the secure-dot1xd process of Juniper Networks on Junos OS and Junos OS Evolved allows an unauthenticated adjacent network attacker to execute code as root or cause a denial of service via an EAPOL frame sent to an 802.1X-authenticated interface. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: QFX Control Plane VXLAN
1926468
Major		When Junos and Junos Evolved platform sends two proxied Neighbor Advertisement for default gateway, second one without Router flag and target Link-Layer address. The second Neighbor Advertisement can disrupt connectivity for end hosts. A proxied Neighbor Advertisement (NA) is an IPv6 mechanism where a network device responds to Neighbor Discovery requests on behalf of another device, instead of the actual endpoint replying itself.
PR NumberCategory: EVO cfmd RE related PRs
1957845
Critical		A Stack-based Buffer Overflow vulnerability in the cfmd process of Juniper Networks Junos OS on MX Series and Junos OS Evolved on PTX Series platforms allows an unauthenticated adjacent-network attacker to execute arbitrary code as root or cause denial of service via a specific CFM Message sent to a configured down-MEP with enhanced CFM mode enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1957850
Critical		An Out-of-bounds Read vulnerability in the cfmd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent-network attacker to crash the daemon and disclose limited process memory via a specific CFM Message sent to a configured interface. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: Firewall related development
1956227
Critical		A Reachable Assertion vulnerability in fwstatsd of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause a denial of service via an SNMP firewall-counter MIB query when at least one firewall counter is configured. Please refer to https://supportportal.juniper.net/JSA112250 [juniper.net] for more information.
PR NumberCategory: EVO Socket replication
1955807
Critical		A Stack-based Buffer Overflow vulnerability in the kernel of Juniper Networks Junos OS Evolved allows an unauthenticated remote attacker to trigger a kernel panic via a crafted TCP packet when key-chain authentication is used for BGP or LDP. Please refer to https://supportportal.juniper.net/JSA112250 [juniper.net] for more information.
PR NumberCategory: AAA, auditd issues
1956332
Critical		An OS Command Injection vulnerability in tacacs of Juniper Networks Junos OS Evolved allows a low-privileged TACACS+-authenticated user to execute commands with root privileges when periodic TACACS+ authorization-refresh is enabled. Please refer to https://supportportal.juniper.net/JSA112250 [juniper.net] for more information.
PR NumberCategory: eventd, syslog infra issues
1953680
Critical		An Out-of-bounds Write vulnerability in eventd of Juniper Networks Junos OS and Junos OS Evolved allows a local attacker to cause a Denial of Service (DoS) via sending a crafted packet to the eventd relay service. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: EVPN control plane issues
1952196
Critical		An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP EVPN peer to cause a denial of service via BGP EVPN route processing when the l2vpn-evpn RIB telemetry sensor is subscribed. Successful exploitation can crash rpd and interrupt routing protocols until the daemon restarts and reconverges. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1952476
Major		An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP EVPN peer to cause an rpd crash via a specifically malformed NLRI. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1952492
Critical		An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos Evolved platforms allows a configured EVPN signaling peer to cause an rpd crash via a malformed SRv6 structure carried in an EVPN route update. The result is a denial of service affecting routing adjacencies. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1952495
Critical		A Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote network attacker to cause a denial of service via EVPN multihoming with preference-based designated-forwarder election. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1953998
Critical		An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker to cause a denial of service via a malformed EVPN Type-3 or Type-4 route received from a configured EVPN peer and processed during re-advertisement. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954001
Critical		An Integer Overflow or Wraparound vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker to cause a denial of service via specially crafted EVPN route updates from an accepted EVPN BGP peer. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954002
Critical		An Integer Overflow or Wraparound vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a remote attacker with an established EVPN BGP peering relationship to cause a denial of service via EVPN BGP route processing. The issue affects EVPN-enabled routing instances and can disrupt control-plane adjacencies. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954478
Critical		A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP/EVPN peer to cause root code execution on Junos OS or an rpd crash on Junos OS Evolved via protocol-valid route advertisements for an EVPN-VPWS service. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: EVPN Layer-2 Forwarding
1951682
Major		On all Junos and Junos Evolved platforms with EVPN-MPLS (Ethernet VPN- Multiprotocol label switching) and VXLAN (Virtual Extensible LAN) stitching , ARP (Address Resolution Protocol) entries learned over a VTEP (Virtual Tunnel Endpoint) interface are not refreshed by re-ARP (unicast ARP refresh) mechanism. As a result, ARP entries can age out and are temporarily removed causing intermittent traffic disruption. This issue will be restored automatically when ARP entries are re-learnt after some delay(several hundreds milli seconds).
PR NumberCategory: Control plane EVPN multicast
1953997
Major		An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker sending a specifically malformed BGP EVPN multicast update which is attempted to be readvertised to cause an rpd crash. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: EX optics issues
1879743
Major		On EX4400-48F and EX4400-24X platforms with SFP-T (740-013111) connected, the ports can flap intermittently. This is related to ports 36-47 on these platforms only, which results in the traffic loss of ~5 seconds.
PR NumberCategory: Enhanced Broadband Edge support for firewall
1902909
Major		An Improper Check for Unusual or Exceptional Conditions vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on MX Series allows adjacent subscribers to bypass configured firewall filters.Please refer to https://supportportal.juniper.net/JSA110091 [juniper.net] for more information.
PR NumberCategory: ACX7332 ACX7348 Interfaces software
1965887
Critical		ACX7020/ACX7024/ACX7024X/ACX73xx/ACX7509/Ufispace is not able to configure "no-temperature-monitoring" for ports higher than 23
PR NumberCategory: ACX7509 Linecard (FPC) related issues
1931707
Minor		On Junos Evolved ACX7509, ACX7348, and ACX7332 platforms, framing errors will be seen on some ACX Evolved platforms when traffic is carried over 40G ports
PR NumberCategory: Internet Group Management Protocol
1958122
Critical		A NULL Pointer Dereference vulnerability in the rpd process of Juniper Networks Junos OS on MX Series and Junos OS Evolved on ACX Series allows an unauthenticated adjacent attacker to cause a denial of service via an IGMPv3 membership report received on a directly connected network. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: Kernel software for AE/AS/Container
1938565
Major		On Junos platforms supporting Ethernet Segment Identifier (ESI) based Aggregated Ethernet (AE) Link Aggregation Group (LAG) deployments, Link Aggregation Control Protocol (LACP) does not return to the expected Attached state when a Graceful Routing Engine Switchover (GRES) occurs on the Provider Edge (PE) device and is followed by an AE member interface flap on the connected device, with lacp-oos-on-ndf (LACP out-of-sync on non-designated forwarder) enabled on the PE.
PR NumberCategory: ISIS routing protocol
1951942
Critical		An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service when IS-IS link protection and backup-selection are configured. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954540
Critical		An Improper Validation of Specified Quantity in Input vulnerability in the routing daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause a denial of service by sending a specific IS-IS SRv6 packet when SRv6 and Flexible Algorithm are enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: Category for JET(JUNOS Extension Toolkit) related issues
1933395
Major		System connections are not established while Subscribing for OC path using ssl local-certificates after upgrading to 24.4R2-S3-EVO. This issue is only applicable on 24.4R2-S3-EVO and 24.4R2-S4-EVO
1963718
Major		An Improper Handling of Highly Compressed Data vulnerability in the gRPC library used by na-grpcd of Juniper Networks Junos OS allows an authenticated network-based attacker to cause a denial of service via a compressed gRPC request. Please refer to https://supportportal.juniper.net/JSA112188 [juniper.net] for more information.
PR NumberCategory: N/A:sw-jsr-flowd-datapath:
1953078
Critical		A Heap-based Buffer Overflow vulnerability in the SVR component of Juniper Networks Junos OS on SRX Series allows an unauthenticated network attacker to cause a denial of service and potentially compromise confidentiality and integrity via malformed IPv4 packets reaching an interface configured for Secure Vector Routing. Please refer to https://supportportal.juniper.net/JSA112186 [juniper.net] for more information.
1953764
Critical		An Integer Underflow (Wrap or Wraparound) vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an adjacent unauthenticated attacker to cause a forwarding-plane denial of service via an ICMP message associated with an SVR carrier session. Please refer to https://supportportal.juniper.net/JSA112186 [juniper.net] for more information.
PR NumberCategory: SRX Firewall Authentication
1953636
Critical		A Stack-based Buffer Overflow vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an L2-adjacent attacker to execute arbitrary code as root via high-availability fabric traffic. Please refer to https://supportportal.juniper.net/JSA112186 [juniper.net] for more information.
1953761
Critical		A Reachable Assertion vulnerability in the srxpfe process of Juniper Networks Junos OS on SRX Series allows an adjacent network attacker to cause a denial of service of the data plane via malformed firewall-authentication synchronization traffic on chassis-cluster fabric interfaces. Please refer to https://supportportal.juniper.net/JSA112186 [juniper.net] for more information.
1953762
Critical		A Signed to Unsigned Conversion Error vulnerability in the srxpfe of Juniper Networks Junos OS on the SRX Series allows an adjacent attacker to cause a denial of service of the data plane via chassis-cluster fabric traffic. Please refer to https://supportportal.juniper.net/JSA112186 [juniper.net] for more information.
PR NumberCategory: SRX TCPLIB related Issue
1879966
Critical		A Use After Free vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). Please refer to https://supportportal.juniper.net/JSA112181 [juniper.net] for more information.
PR NumberCategory: IPSEC/IKE VPN
1951651
Critical		A Stack-based Buffer Overflow vulnerability in the iked IKE key-management daemon of Juniper Networks Junos OS on the SRX Series allows an authenticated remote-access VPN client to execute code with root privileges or cause denial of service via the remote-access VPN authentication and JIMS identity-publishing path. Please refer to https://supportportal.juniper.net/JSA112186 [juniper.net] for more information.
PR NumberCategory: Security platform jweb support
1954482
Critical		A Stack-based Buffer Overflow vulnerability in the httpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to cause remote code execution and denial of service via a J-Web virtual-domain configured. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954503
Critical		An Improper Authentication vulnerability in J-Web of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to bypass J-Web authentication and execute CGI content with elevated privileges via a crafted HTTP request. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: Key Management Daemon
1952216
Critical		A Stack-based Buffer Overflow vulnerability in the kmd component of Juniper Networks Junos OS on MX Series allows an unauthenticated network attacker to execute code as root via specific IKE certificate-based packets. Please refer to https://supportportal.juniper.net/JSA112196 [juniper.net] for more information.
PR NumberCategory: Layer 2 Control Module
1957359
Critical		An Improper Validation of Consistency within Input vulnerability in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated Layer 2 attacker to cause a denial of service in associated Layer 2 control protocols via a crafted MVRP Ethernet frame sent to an MVRP-enabled interface. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1957361
Critical		An Allocation of Resources Without Limits or Throttling vulnerability in the l2cpd process of Juniper Networks Junos OS allows an adjacent unauthenticated attacker to cause a denial of service and l2cpd restart via FNP-enabled Layer 2 interfaces. The issue is triggered when the FNP feature is enabled on a VPLS routing instance with VLAN-VPLS encapsulation enabled. Please refer to https://supportportal.juniper.net/JSA112188 [juniper.net] for more information.
1957363
Critical		A Stack-based Buffer Overflow vulnerability in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service or execute arbitrary code with root privileges via LLDP traffic received on an interface with Unified Access Policy enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1957368
Critical		A Stack-based Buffer Overflow vulnerability in the l2cpd daemon of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service in Layer 2 control-plane processing via LLDP packets received on an interface configured for LLDP. Repeated triggering may disrupt LLDP and other Layer 2 control protocols across the device. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1957373
Critical		An Improper Release of Memory Before Removing Last Reference vulnerability in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved platforms allows an adjacent unauthenticated attacker to cause l2cpd memory exhaustion and Layer 2 control-plane disruption via LLDP traffic when fast receive processing is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: Layer2 forwarding on EX/NFX/PTX/QFX
1956577
Critical		A Missing Release of Memory after Effective Lifetime vulnerability in the l2ald process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via crafted packets when the static MAC-IP feature is in use. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956583
Critical		A Reachable Assertion vulnerability in l2ald of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause a denial of service via an ICCP peer message when MC-LAG IRB MAC synchronization is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956599
Critical		An Integer Overflow or Wraparound vulnerability in the l2ald process of Juniper Networks Junos OS and Junos OS Evolved allows a configured EVPN BGP peer to cause a denial of service via EVPN Type-2 MAC/IP routes. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1957705
Critical		An Improper Release of Memory Before Removing Last Reference vulnerability in the l2ald process of Juniper Networks Junos OS and Junos OS Evolved on QFX5K-family platforms allows a configured EVPN peer to cause a denial of service through memory exhaustion via EVPN-VXLAN active-active multihoming route processing. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1957710
Critical		An Improper Handling of Length Parameter Inconsistency vulnerability in L2ALM of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to obtain stale PFE packet memory via VXLAN overlay-ping traffic sent to a local VTEP. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: lacp protocol
1956919
Critical		An Out-of-bounds Write vulnerability in lacpd of Juniper Networks Junos OS Evolved allows a Layer-2-adjacent attacker to cause a denial of service via a crafted frame received on an LACP-enabled aggregated-Ethernet member port. Refer to https://supportportal.juniper.net/JSA112250 [juniper.net]
PR NumberCategory: Label Distribution Protocol
1954119
Critical		A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos EVO allows an adjacent attacker to cause a denial of service via an established LDP session carrying an IPv6 Prefix FEC in a specific Label message. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954120
Critical		A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos EVO allows an adjacent unauthenticated attacker to cause a denial of service via LDP control traffic. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954127
Critical		A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos EVO allows an adjacent attacker to cause a denial of service via an established LDP session when two misconfigured neighbors (or one neighbor duplicated by an L2 loop) advertise the same transport address on a link-protected interface. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: JDHCP is a daemon for EVO platform to handle DHCP protocol
1957664
Critical		A Stack-based Buffer Overflow vulnerability in the jdhcpd process of Juniper Networks Junos OS and Junos OS Evolved platforms allows an adjacent unauthenticated attacker to cause denial of service or execute arbitrary code with root privileges via a malformed DHCPv4 server response when the DHCPv4 local-client feature is used. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1957862
Critical		A Stack-based Buffer Overflow vulnerability in the jdhcpd process of Juniper Networks Junos OS allows an unauthenticated adjacent attacker to cause a denial of service via a DHCP client response. The issue affects DHCP client operation and can interrupt related DHCP, relay, and zero-touch-provisioning services. Please refer to https://supportportal.juniper.net/JSA112188 [juniper.net] for more information.
PR NumberCategory: mc-ae interface
1954885
Major		An Improper Handling of Length Parameter Inconsistency vulnerability in the l2ald daemon of Juniper Networks Junos OS and Junos OS Evolved allows an attacker who can control or impersonate a configured MC-LAG ICCP peer to disclose process heap memory or cause a denial of service via a malformed ICCP message. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954888
Major		An Improper Validation of Specified Quantity in Input vulnerability in the l2ald of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker with access to an ICCP peer session to cause memory disclosure and disruption of the l2ald daemon via malformed ICCP packets. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954889
Major		A Reachable Assertion vulnerability in the l2ald daemon of Juniper Networks Junos OS and Junos OS Evolved devices configured for MC-LAG/ICCP allows an adjacent attacker to cause a denial of service via an inconsistent ICCP peer message. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956578
Critical		An Improper Validation of Specified Quantity in Input vulnerability in l2ald of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause a denial of service via an ICCP MC-LAG message. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956580
Critical		A Reachable Assertion vulnerability in the l2ald daemon of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured ICCP peer to cause a denial of service via a malformed MC-LAG message. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: Multiprotocol Label Switching
1908614
Major		An Incomplete List of Disallowed Inputs vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS). Please refer to https://supportportal.juniper.net/JSA112168 [juniper.net] for more information.
1956673
Critical		A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP-LS peer to cause a denial of service via a BGP-LS update. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: Multicast for L3VPNs
1953081
Critical		An Improper Validation of Consistency within Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-adjacent configured BGP peer to cause a denial of service by sending a specifically malformed BGP MCAST-TREE update and this NLRI is then attempted to be readvertised. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954493
Major		A Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS Evolved on PTX Series allows an unauthenticated IS-IS peer to cause a denial of service. Please refer to https://supportportal.juniper.net/JSA112250 [juniper.net] for more information.
1955224
Major		A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker to cause rpd crash via malformed BGP MCAST-VPN updates from a configured eBGP peer. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956148
Critical		An Improper Validation of Specified Quantity in Input vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP MVPN peer to cause a denial of service via a BGP MVPN signaling update. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956262
Critical		An Incomplete Cleanup vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a configured MVPN neighbor to cause a denial of service via a BGP MVPN update when an interregion segmented VRF with 'protocols mvpn inter-region-template' is configured. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: FreeBSD Kernel Infrastructure
1932893
Major		vmhost upgrade may fail due to 'Validation failed' when upgrading to freebsd15 based Junos from older releases. This does not apply to Junos-EVO.
PR NumberCategory: ISO network family related
1954427
Critical		An Integer Underflow vulnerability in the kernel of Juniper Networks Junos OS with Extended Echo configured allows an unauthenticated, network-based attacker to cause a denial of service by a kernel crash. Please refer to https://supportportal.juniper.net/JSA112188 [juniper.net] for more information.
PR NumberCategory: SCTP kernel issues
1957225
Critical		A Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in netsctp.ko of Juniper Networks Junos OS on MX Series allows an unauthenticated network attacker to cause a denial of service via crafted SCTP network traffic. Please refer to https://supportportal.juniper.net/JSA112196 [juniper.net] for more information.
PR NumberCategory: OSPF routing protocol
1951247
Critical		An Integer Overflow or Wraparound vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via specific OSPFv2 packets sent on an OSPF-enabled interface. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1951273
Critical		An Improper Validation of Specified Quantity in Input vulnerability in rpd of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent OSPF peer to disclose rpd memory or cause a rpd crash via a malformed OSPF packets. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1951277
Critical		A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent OSPF peer to cause a denial of service via OSPF traffic processed while OSPF Source Packet Routing best-route Prefix-SID installation is configured. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1958211
Critical		An Allocation of Resources Without Limits or Throttling vulnerability in rpd, the routing protocol daemon, of Juniper Networks Junos OS and Junos OS Evolved platforms allows an unauthenticated adjacent attacker to cause a denial of service and heap memory corruption via OSPFv3 messages on an enabled broadcast interface. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: Used for tracking OVSDB software issues and features
1950782
Critical		A Heap-based Buffer Overflow vulnerability in the VXLAN Gateway Daemon (vgd) of Juniper Networks Junos OS allows a malicious or compromised SDN-controller to cause a complete outage of the OVSDB control plane and possibly remote code execution. Please refer to https://supportportal.juniper.net/JSA112188 [juniper.net] for more information.
PR NumberCategory: MPLS Point-to-Multipoint TE
1954123
Major		A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause an rpd crash via a crafted LDP packet received over an established LDP session. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954449
Major		A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent LDP peer to cause an rpd crash or execute arbitrary code via a malformed LDP Label Mapping message. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954545
Major		A NULL Pointer Dereference vulnerability in the routing protcol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via LDP messages received over an operational LDP session. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954547
Major		A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a compromised LDP neighbor to cause an rpd crash via a crafted LDP message. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: Phone-Home-Client Infrastructure
1954221
Critical		An OS Command Injection vulnerability in the bootzd zero-touch provisioning daemon of Juniper Networks Junos OS Evolved allows an unauthenticated attacker on the management LAN to execute commands as root via crafted DHCP response if the management-instance configuration enabled. Please refer to https://supportportal.juniper.net/JSA112250 [juniper.net] for more information.
1954222
Critical		An OS Command Injection vulnerability in the bootzd zero-touch provisioning daemon of Juniper Networks Junos OS Evolved allows an unauthenticated attacker on the management LAN to execute commands as root via a crafted gRPC response. Please refer to https://supportportal.juniper.net/JSA112250 [juniper.net] for more information.
1958116
Critical		An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the phone-home daemon (phcd) of Juniper Networks Junos OS and Junos OS Evolved on EX Series, SRX Series, and QFX Series allows an adjacent unauthenticated attacker to execute arbitrary commands with root privileges via a rogue DHCP server. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1958129
Major		A Stack-based Buffer Overflow vulnerability in the phone-home daemon (phcd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to execute arbitrary code as root via a crafted DHCP SZTP bootstrap message. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: Protocol Independant Multicast
1956154
Critical		An Out-of-bounds Write vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated attacker to cause a routing-plane denial of service via Auto-RP mapping announcements received when Auto-RP mapping is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956156
Critical		A NULL Pointer Dereference vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial-of-service condition via a malformed PIM Bidir message. Refer to https://supportportal.juniper.net/JSA112187 [juniper.net]
1958191
Critical		An Improper Input Validation vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via a malformed PIM Hello message received on an IPv6-enabled PIM interface. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1958197
Critical		A Use After Free vulnerability in the rpd PIM Join/Prune processing of Juniper Networks Junos OS and Junos OS Evolved platforms allows an unauthenticated adjacent attacker to crash the routing daemon via specific PIM messages when sparse mode PIM is configured. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: Issues related to PKI daemon
1951251
Critical		A NULL Pointer Dereference vulnerability in the pkid component of Juniper Networks Junos OS allows an unauthenticated remote attacker to cause a denial of service via a malformed packet received during CMP enrollment or automatic certificate re-enrollment. Please refer to https://supportportal.juniper.net/JSA112188 [juniper.net] for more information.
PR NumberCategory: Periodic Packet Management Daemon
1935823
Major		On all Junos and Junos OS Evolved platforms when GRES (Graceful Routing Engine Switchover) is enabled and any other protocol dependent on Periodic Packet Management (PPM) in non-centralised mode(distributed to FPC's) is configured, after an RE (Routing Engine) switchover, the protocol fails to recover, resulting in services dependent on the protocol to go down.
PR NumberCategory: QFX L3 data-plane/forwarding
1947250
Major		On QFX5K and EX4K platforms, next-hop updates for host routes in the LPM table may fail when the lpm-profile is configured without the unicast-in-lpm option. This can result in stale next-hop entries in hardware, causing traffic to continue forwarding over invalid or costed-out paths.
PR NumberCategory: QFX EVPN / VxLAN
1877194
Major		On Junos EX4400, EX4400-24T, EX4400-24X, EX4400-48T, EX4400-48F, EX4400-24MP, EX4400-48MP, EX4300-MP platforms, it is observed that in a scaled scenario with more than three thousand next hops configured, further next hop installation fails which in turn causes routes to fail leading to traffic drop.
PR NumberCategory: Routing Information Protocol
1956181
Critical		An Improper Validation of Specified Quantity in Input vulnerability in the rpd process of Juniper Networks Junos OS and Junos Evolved allows an unauthenticated adjacent attacker to cause a denial-of-service condition via a malformed RIPv2 message. Refer to https://supportportal.juniper.net/JSA112187 [juniper.net]
PR NumberCategory: rosen-6 and rosen-7 mvpn bugs
1958185
Major		An Integer Underflow (Wrap or Wraparound) vulnerability in the rpd process of Juniper Networks Junos OS on EX Series and MX Series, and Junos OS Evolved on ACX Series allows an unauthenticated adjacent attacker to cause heap memory disclosure and multicast join-state injection via a malformed Rosen-MVPN message. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: Issues related to dynamic-tunnels routing infrastructure
1955227
Major		An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated BGP peer to cause an rpd crash via a malformed BGP-signaled SRv6 service route when SRv6 dynamic tunnels are enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: RPD Next-hop issues including indirect, CNH, and MCNH
1955220
Minor		A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos on MX Series routers allows an unauthenticated network attacker to cause a denial of service via an eBGP route update when HFRR link protection is configured in a VRF. Please refer to https://supportportal.juniper.net/JSA112196 [juniper.net] for more information.
PR NumberCategory: RPD policy options
1953062
Critical		A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP peer to cause a persistent routing-daemon denial of service via a specific BGP packet when ephemeral configuration is used. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1953954
Critical		A NULL Pointer Dereference vulnerability in the routing protocol daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows a configured peer sending a BGP UPDATE to cause a denial of service when an import policy with `then source-based-forwarding next-hop next-table ` is configured to reference a routing table that does not exist. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1953965
Critical		A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP neighbor to cause a denial of service via a BGP route update when specific routing-policy resolution-map and policy event-tracing configuration is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: RPD route tables, resolver, routing instances, static routes
1956233
Critical		An Integer Overflow or Wraparound vulnerability in the routing daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated BGP peer to cause a denial of service via BGP route updates when extended-nexthop-tunnel is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956235
Critical		A Mismatched Memory Management Routines vulnerability in the routing protocol daemon (rpd) process of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated network-based attacker to cause a denial of service via a BGP route update when extended next-hop tunneling and SRv6 service processing are used. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: multicast source distribution protocol
1956260
Critical		A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated configured MSDP peer or adjacent PIM sender to cause a denial of service via an MSDP or PIM policy that uses AS-path expansion. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: Resource Reservation Protocol
1955230
Critical		A Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service via a malformed RSVP packet when RSVP is enabled on the receiving interface. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1955500
Major		An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service via a crafted RSVP packet when L2 LSP support is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information
1956204
Critical		A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent network attacker to cause a denial of service via a crafted RSVP packet when MPLS-TE RSVP processing is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956651
Critical		A NULL Pointer Dereference vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause a denial of service via a malformed RSVP Path message received on an EVPL LMP control channel. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956653
Critical		A NULL Pointer Dereference vulnerability in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to crash the routing daemon and cause a denial of service via an RSVP Path message. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956659
Critical		A Reachable Assertion vulnerability in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated network attacker to cause a denial of service via malformed RSVP signaling when RSVP is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956663
Critical		A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to crash the routing process via RSVP-TE associated-bidirectional LSP signaling. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1962883
Major		A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via a specific RSVP packet. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: RPM and TWAMP
1958232
Major		A Reachable Assertion vulnerability in the Two-Way Active Measurement Protocol (TWAMP) client of Juniper Networks Junos OS allows an unauthenticated network-based attacker to cause rmopd service disruption via a specific TCP packet. Please refer to https://supportportal.juniper.net/JSA112188 [juniper.net] for more information
PR NumberCategory: SNMP Infrastructure (snmpd, mib2d)
1954250
Critical		A Stack-based Buffer Overflow vulnerability in the authd Juniper Networks Junos OS and Junos OS Evolved allows a network attacker with SNMP read access to execute code with root privileges or cause a denial of service via a specific SNMP packet, when SNMP and AAA are enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: Segment routing traffic Engineering
1956203
Critical		A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated network-based attacker to cause a denial of service via BGP-LS routing updates. Refer to https://supportportal.juniper.net/JSA112187 [juniper.net]
1956205
Critical		A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP-LS peer to cause an rpd crash via a crafted BGP-LS Link NLRI advertisements. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: SRX Advanced Anti-Malware module
1955171
Major		An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ipfd of Juniper Networks Junos OS on SRX Series allows an unauthenticated network-based attacker to execute code with root privileges via a configured Security Intelligence feed connection. Please refer to https://supportportal.juniper.net/JSA112186 [juniper.net] for more information.
1955172
Major		An Use of Externally-Controlled Format String vulnerability in the ipfd daemon of Juniper Networks Junos OS on SRX Series allows an unauthenticated network-based attacker to execute code with root privileges via a compromised or impersonated configured HTTPS feed server. Please refer to https://supportportal.juniper.net/JSA112186 [juniper.net] for more information
PR NumberCategory: SRX branch platforms
1913911
Major		On SRX300-series devices, when ethernet-switching is used with spanning-tree protocol enabled, in some cases ARP reply packets may be sent out from a spanning-tree blocked port.
1943202
Minor		On all Junos OS and Junos OS Evolved platforms, when copying a file to a remote host using a hostname, the device is unable to resolve the hostname, causing the file transfer to fail. Secure Copy (SCP) operations are not affected and continue to work as expected. This issue does not impact network services or device functionality.
1960745
Major		On all SRX300/320/340/345 platforms, when ICU (In-cluster upgrade) is performed, the first node gets upgraded but the secondary node fails to come up within the timeout window of 20 mins. Service impact will be observed as the ICU upgrade fails.
PR NumberCategory: UI Infrastructure - mgd, DAX API, DDL/ODL
1951668
Critical		A Heap-based Buffer Overflow vulnerability in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated attacker who can control or intercept the configured SDX/SRC server connection to execute code as root or cause denial of service via a crafted frame received over the service-deployment TCP connection. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: Issues related to Logging/Tracing, errmsg, eventd infrastruc
1953674
Critical		A Heap-based Buffer Overflow vulnerability in eventd of Juniper Networks Junos OS and Junos OS Evolved on all platforms allows an unprivileged local attacker to cause a denial of service (DoS) or achieve privilege escalation to root via crafted IPC event messages. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: anti spam bugs
1953149
Critical		A Stack-based Buffer Overflow vulnerability in the UTM Anti-Spam SBL of Juniper Networks Junos OS on SRX series allows an unauthenticated remote attacker to cause arbitrary code execution or a denial of service via a injected malformed DNS packet when Anti-Spam SBL inspection is enabled.Please refer to the https://supportportal.juniper.net/JSA112186 [juniper.net] for more information.
PR NumberCategory: web filterig issues
1956639
Critical		An XML Injection vulnerability in the Unified Threat Management daemon (utmd) of Juniper Networks Junos OS on SRX Series devices allows an unauthenticated network attacker to commit arbitrary device configuration with root priviledges via a malicious response from a configured custom URL-feed server. Please refer to https://supportportal.juniper.net/JSA112186 [juniper.net] for more information.
PR NumberCategory: Virtual Private LAN Services
1954879
Major		An Improper Input Validation vulnerability in the routing protocol daemon (rpd) process of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP peer to cause an rpd crash via a BGP VPLS signaling update. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954880
Major		A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent eBGP peer to cause a denial of service via a VPLS signaling update when automatic site-ID negotiation is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956248
Critical		A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote BGP peer to cause a denial of service when multiple UPDATEs occur over a single TCP session with 'bgp family l2vpn auto-discovery-only' configured. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.

 

 

Modification History

First publication 2026-10-14

Updated 2026-10-20 to include recently published PRs related to the SIRT October 2026 JSA Announcement.