Alert Type

SRN - Software Release Notification
Low/NotificationSoftware Release Notification
Low/NotificationSoftware Release Notification

Product Affected

Routing, Switching, and Security Platforms running Junos software version 25.4R1-S3

Alert Description

Junos Software Service Release version 25.4R1-S3 is now available for download from the Junos software download site

Download Junos Software Service Release:

  1. Go to Junos Platforms - Download Software page
  2. Input your product in the "Find a Product" search box
  3. From the Type/OS drop-down menu, select Junos SR
  4. From the Version drop-down menu, select your version
  5. Click the Software tab
  6. Select the Install Package as need and follow the prompts

NOTE: Starting on August 30th, 2024, we include PR's severity with each entry. See KB86335 [juniper.net] for the definition of PR's Severity

Junos Selective Update (JSU) feasible

Not applicable

Call to Action

For your review.

Solution

Junos Software service Release version 25.4R1-S3 is now available.

25.4R1-S3 - List of Fixed issues

PR NumberCategory: Junos SDK PRs specific to the Services SDK
1951698
Critical		A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in the SDK service process of Juniper Networks Junos OS allows an unauthenticated network attacker to cause a denial of service or compromise the Routing Engine by sending specific packets when the SDK service and a JDAF routing instance are enabled. Please refer to https://supportportal.juniper.net/JSA112188 [juniper.net] for more information.
PR NumberCategory: SPC3 HW and SW Issues
1922949
Critical		On Junos SRX5000 series platforms with Services Processing Card 3 (SPC3), executing the unsupported operational command "show pfe statistics dma" causes loss of communication between the Packet Forwarding Engine (PFE) and the Routing Engine (RE), triggering a system-wide Flexible PIC Concentrator reset and resulting in a complete traffic outage.
PR NumberCategory: SRX Fleming L2NG platform support
1911533
Minor		On SRX1600 switching mode, table full error message displayed even the L2 table is not full
PR NumberCategory: SRX Fleming Platforms related issues
1916697
Minor		MAC limit Count show 65k in srx1600, but it stops learning at 28k.
PR NumberCategory: SRX Fleming Broadcom TD3/SDK, datapath related issue
1943275
Critical		On SRX1600, SRX2300 and SRX4300 platforms, upon configuring "set protocols l2-learning global-mode switching" where 1G SFP is used on 10G port the port goes down after sometime causing traffic drop. This traffic drop is only subjected to the port where the configuration is applied, thus the other ports remains unaffected.
PR NumberCategory: "agentd" software daemon
1954177
Major		An Use of Externally-Controlled Format String vulnerability in the gRPC daemon of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause telemetry-service disruption, information disclosure, or potential root-level code execution via a crafted message to the gNMI service. Please refer to https://supportportal.juniper.net/JSA112250 [juniper.net] for more information.
1954178
Critical		A Reachable Assertion vulnerability in the na-grpcd process of Juniper Networks Junos OS and Junos EVO allows a remote unauthenticated attacker to cause a denial of service via a gRPC telemetry subscription request. Please refer to https://supportportal.juniper.net/JSA112250 [juniper.net] for more information.
1954180
Critical		A NULL Pointer Dereference vulnerability in the na-grpcd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated attacker with access to the chassis-internal network to cause a denial of service via a network message. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: ACX7020 Lite Platform interface issues
1959044
Minor		On ACX7020 platforms, when there is the requirement for having 100 Mbps CLI (also known as Antman NPI) connection for management, this is not supported for a specific Junos version
PR NumberCategory: Application Quality of Experience
PR NumberCategory: Bi Directional Forwarding Detection (BFD)
1958106
Critical		A Reachable Assertion vulnerability in the bfdd daemon of Juniper Networks Junos OS and Junos OS Evolved platforms allows an unauthenticated adjacent attacker to cause a denial of service by restarting the daemon via crafted BFD session traffic. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: Border Gateway Protocol
1952192
Critical		A Stack-based Buffer Overflow vulnerability in the BGP routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP flowspec peer to cause routing-engine compromise or a routing-daemon denial of service via flowspec route re-advertisement when BGP update-threading is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1952197
Critical		A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP peering session to cause a denial of service by sending a crafted BGP route attribute, which is processed while a BGP RIB streaming telemetry subscription is active. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1952737
Critical		A Numeric Truncation Error vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker to cause a denial of service via a BGP Prefix-SID route advertisement that is subsequently re-advertised. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1953061
Critical		An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an eBGP peer which has not negotiated four-octet-AS capability sending a specifically malformed BGP update to cause a Denial-of-Service (DoS). Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1953065
Critical		A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated remote BGP neighbor to cause a denial of service via a VPN-flowspec BGP update if it is readvertised and BMP post-policy RIB-out monitoring is configured. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1953085
Critical		An Improper Validation of Consistency within Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP ISO-VPN peer to cause an rpd crash by sending a specific ISO-VPN update which is then processed by BMP route monitoring or NSR. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1953394
Critical		An Improper Initialization vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote BGP peer to cause an rpd crash via an LLGR-stale route update readvertised to a configured non-LLGR peer group. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1953397
Critical		A Function Call With Incorrect Variable or Reference as Argument vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause an rpd crash via specifically malformed LSP-ping. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1953399
Major		An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS Evolved on QFX5240, QFX5241 and QFX5250 configured for BGP global-load-balancing and more than 128 ecmp next-hops allows an attacker to cause an rpd crash. Please refer to https://supportportal.juniper.net/JSA112250 [juniper.net] for more information.
1953950
Critical		A NULL Pointer Dereference vulnerability in the routing-policy nexthop-ECMP matcher of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP peer to cause a routing-daemon denial of service via a specific BGP packet received while a nexthop-ecmp qualifier is attached to a BGP import policy. Refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1953962
Critical		A NULL Pointer Dereference vulnerability in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated configured BGP peer to cause a denial of service via a BGP UPDATE when ISO-VPN and egress-protection configuration is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954000
Critical		An Improper Input Validation vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker to cause a denial of service via a crafted BGP EVPN update message. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954487
Major		A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-adjacent BGP peer to cause a denial of service when labeled-unicast aggregate-label is configured. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954857
Critical		A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote configured BGP peer to cause an rpd crash or, on Junos OS, remote code-execution via sending a flow-spec update selected for re-advertisement. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954860
Critical		An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP-LS peer to cause heap data disclosure via a malformed UPDATE sent over a session with the traffic-engineering address family enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956236
Critical		An Improper Control of a Resource Through its Lifetime vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent eBGP peer to cause a routing-daemon crash via a BGP route update when RIB sharding is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: BGP BMP Software
1952604
Critical		A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated BGP peer to cause a denial of service and potential root-level command execution via crafted BGP route updates when the BGP Monitoring Protocol (BMP) is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1952739
Critical		A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured external BGP neighbor to execute arbitrary commands with root privileges via BMP route monitoring. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: BBE Remote Access Server
1954232
Critical		A Stack-based Buffer Overflow vulnerability in the authd process of Juniper Networks Junos OS allows an attacker able to influence a configured RADIUS server to cause authd to crash or execute code with root privileges via a malicious RADIUS response. Please refer to https://supportportal.juniper.net/JSA112188 [juniper.net] for more information.
PR NumberCategory: QFX Access Control related
1955815
Major		A Stack-based Buffer Overflow vulnerability in the dot1x daemon of Juniper Networks Junos OS devices operating as Junos Fusion Aggregation Devices allows an adjacent attacker acting as the configured ICCP peer to cause a denial of service and potentially execute code as root via. The issue is triggered when dot1x synchronization is enabled for the required Fusion satellite topology. Please refer to https://supportportal.juniper.net/JSA112188 [juniper.net] for more information.
1956093
Critical		A Heap-based Buffer Overflow vulnerability in the secure-dot1xd process of Juniper Networks on Junos OS and Junos OS Evolved allows an unauthenticated adjacent network attacker to execute code as root or cause a denial of service via an EAPOL frame sent to an 802.1X-authenticated interface. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: JDM issues in CSDS solution
1925031
Critical		An OS command injection vulnerability in the CLI of Juniper Networks Junos OS allows a local, low privileged attacker to take complete control of the device. Please refer to https://supportportal.juniper.net/JSA112180 [juniper.net] for more information.
PR NumberCategory: DNS software support.
1851909
Critical		An Unchecked Return Value vulnerability in the DNS module of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). Please refer to https://supportportal.juniper.net/JSA106020 [juniper.net] for more information.
PR NumberCategory: JUNOS kernel/ukernel changes for DNX
1948145
Major		On ACX5448 platform, a high amount of disk I/O leads to a deadlock, which triggers a panic reboot and a vmcore file is generated. During device restart, all services are temporarily unavailable.
PR NumberCategory: EVO cfmd RE related PRs
1957845
Critical		A Stack-based Buffer Overflow vulnerability in the cfmd process of Juniper Networks Junos OS on MX Series and Junos OS Evolved on PTX Series platforms allows an unauthenticated adjacent-network attacker to execute arbitrary code as root or cause denial of service via a specific CFM Message sent to a configured down-MEP with enhanced CFM mode enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1957850
Critical		An Out-of-bounds Read vulnerability in the cfmd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent-network attacker to crash the daemon and disclose limited process memory via a specific CFM Message sent to a configured interface. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: EVO Class of Services
1930528
Major		set class-of-service host-outbound-traffic dscp-code-point was disabled on PTX in 25.4R1. Later it was enabled in 26.2R1 and backported to 25.4R2
PR NumberCategory: Firewall related development
1956227
Critical		A Reachable Assertion vulnerability in fwstatsd of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause a denial of service via an SNMP firewall-counter MIB query when at least one firewall counter is configured. Please refer to https://supportportal.juniper.net/JSA112250 [juniper.net] for more information.
PR NumberCategory: EVO linux defects & enhancement requests
1939674
Major		On all Junos OS Evolved platforms, due to linux kernel issue, periodical sync from system time to RTC (Real-Time Communication) every 11min stops working when system time moves to backwards.
PR NumberCategory: AAA, auditd issues
1956332
Critical		An OS Command Injection vulnerability in tacacs of Juniper Networks Junos OS Evolved allows a low-privileged TACACS+-authenticated user to execute commands with root privileges when periodic TACACS+ authorization-refresh is enabled. Please refer to https://supportportal.juniper.net/JSA112250 [juniper.net] for more information.
PR NumberCategory: eventd, syslog infra issues
1919638
Major		On Junos EVO platforms, frequent trace file rotation may cause certain EVO applications to become unresponsive.
1953680
Critical		An Out-of-bounds Write vulnerability in eventd of Juniper Networks Junos OS and Junos OS Evolved allows a local attacker to cause a Denial of Service (DoS) via sending a crafted packet to the eventd relay service. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: mgd, ddl, odl infra issues
1954021
Minor		On all Junos OS Evolved platforms, when a CLI(Command Line Interface) session times out, it triggers a terminal reset which clears the visible screen and scrollback buffer. As a result, users are unable to view previous command outputs.
1957073
Major		On Junos OS Evolved platforms, when both rib-sharding and the ephemeral database are enabled, committing any routing related configuration changes cause the rpd process to crash thus result in routing protocol disruption and traffic impact until the routing process recovers.
1966115
Minor		On Junos OS Evolved platforms that support dual Routing Engine(RE) but are operating with a single RE, NETCONF commit operations incorrectly display the "graceful-switchover is enabled, commit synchronize should be used" warning when Graceful Routing Engine Switchover (GRES) is enabled. The warning is cosmetic, and NETCONF commit operations complete successfully despite the warning. Existing traffic forwarding and control plane operation are not affected.
PR NumberCategory: EVPN control plane issues
1952196
Critical		An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP EVPN peer to cause a denial of service via BGP EVPN route processing when the l2vpn-evpn RIB telemetry sensor is subscribed. Successful exploitation can crash rpd and interrupt routing protocols until the daemon restarts and reconverges. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1952476
Major		An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP EVPN peer to cause an rpd crash via a specifically malformed NLRI. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1952492
Critical		An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos Evolved platforms allows a configured EVPN signaling peer to cause an rpd crash via a malformed SRv6 structure carried in an EVPN route update. The result is a denial of service affecting routing adjacencies. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1952495
Critical		A Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote network attacker to cause a denial of service via EVPN multihoming with preference-based designated-forwarder election. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1953998
Critical		An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker to cause a denial of service via a malformed EVPN Type-3 or Type-4 route received from a configured EVPN peer and processed during re-advertisement. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954001
Critical		An Integer Overflow or Wraparound vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker to cause a denial of service via specially crafted EVPN route updates from an accepted EVPN BGP peer. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954002
Critical		An Integer Overflow or Wraparound vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a remote attacker with an established EVPN BGP peering relationship to cause a denial of service via EVPN BGP route processing. The issue affects EVPN-enabled routing instances and can disrupt control-plane adjacencies. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954029
Major		An Incorrect Calculation vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos EVO allows a remote BGP EVPN neighbor to cause an rpd crash when SRv6 EVPN multihoming is configured.Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954478
Critical		A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP/EVPN peer to cause root code execution on Junos OS or an rpd crash on Junos OS Evolved via protocol-valid route advertisements for an EVPN-VPWS service. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: EVPN Layer-2 Forwarding
1951682
Major		On all Junos and Junos Evolved platforms with EVPN-MPLS (Ethernet VPN- Multiprotocol label switching) and VXLAN (Virtual Extensible LAN) stitching , ARP (Address Resolution Protocol) entries learned over a VTEP (Virtual Tunnel Endpoint) interface are not refreshed by re-ARP (unicast ARP refresh) mechanism. As a result, ARP entries can age out and are temporarily removed causing intermittent traffic disruption. This issue will be restored automatically when ARP entries are re-learnt after some delay(several hundreds milli seconds).
PR NumberCategory: Control plane EVPN multicast
1953997
Major		An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker sending a specifically malformed BGP EVPN multicast update which is attempted to be readvertised to cause an rpd crash. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: EX4400 PFE software
1939656
Major		IPv6 neighbor is not switching to the correct Redundant Trunk Group (RTG) link when we bring back up the primary link after a failover scenerio. Switching from the primary link to the standby works ok, but when switching back, the ipv6 neighbor still points to the standby link causing traffic to blackhole to that destination. Ipv4 arp works ok.
PR NumberCategory: SRX1500 platform software
1932505
Minor		On SRX1500 platform, when an SFP-T transceiver port (ge-0/0/12 to ge-0/0/15) is administratively disabled, the local interface shows down, but the link on the peer device remains up. The link status of a disabled SFP-T port on SRX1500 is down, but peer remote port remains up.
PR NumberCategory: N/A:sw-grpc-dialout:
1954179
Major		A Use of Externally-Controlled Format String vulnerability in the jti-dialoutd of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause persistent telemetry dial-out denial of service via a crafted analytics sensor resource submitted through gNMI listener. Please refer to https://supportportal.juniper.net/JSA112250 [juniper.net] for more information.
PR NumberCategory: Internet Group Management Protocol
1958122
Critical		A NULL Pointer Dereference vulnerability in the rpd process of Juniper Networks Junos OS on MX Series and Junos OS Evolved on ACX Series allows an unauthenticated adjacent attacker to cause a denial of service via an IGMPv3 membership report received on a directly connected network. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: ISIS routing protocol
1951942
Critical		An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service when IS-IS link protection and backup-selection are configured. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954540
Critical		An Improper Validation of Specified Quantity in Input vulnerability in the routing daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause a denial of service by sending a specific IS-IS SRv6 packet when SRv6 and Flexible Algorithm are enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: Category for JET(JUNOS Extension Toolkit) related issues
1963718
Major		An Improper Handling of Highly Compressed Data vulnerability in the gRPC library used by na-grpcd of Juniper Networks Junos OS allows an authenticated network-based attacker to cause a denial of service via a compressed gRPC request. Please refer to https://supportportal.juniper.net/JSA112188 [juniper.net] for more information.
PR NumberCategory: N/A:sw-jsr-flowd-datapath:
1953078
Critical		A Heap-based Buffer Overflow vulnerability in the SVR component of Juniper Networks Junos OS on SRX Series allows an unauthenticated network attacker to cause a denial of service and potentially compromise confidentiality and integrity via malformed IPv4 packets reaching an interface configured for Secure Vector Routing. Please refer to https://supportportal.juniper.net/JSA112186 [juniper.net] for more information.
1953764
Critical		An Integer Underflow (Wrap or Wraparound) vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an adjacent unauthenticated attacker to cause a forwarding-plane denial of service via an ICMP message associated with an SVR carrier session. Please refer to https://supportportal.juniper.net/JSA112186 [juniper.net] for more information.
PR NumberCategory: SRX Firewall Authentication
1953636
Critical		A Stack-based Buffer Overflow vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an L2-adjacent attacker to execute arbitrary code as root via high-availability fabric traffic. Please refer to https://supportportal.juniper.net/JSA112186 [juniper.net] for more information.
1953761
Critical		A Reachable Assertion vulnerability in the srxpfe process of Juniper Networks Junos OS on SRX Series allows an adjacent network attacker to cause a denial of service of the data plane via malformed firewall-authentication synchronization traffic on chassis-cluster fabric interfaces. Please refer to https://supportportal.juniper.net/JSA112186 [juniper.net] for more information.
1953762
Critical		A Signed to Unsigned Conversion Error vulnerability in the srxpfe of Juniper Networks Junos OS on the SRX Series allows an adjacent attacker to cause a denial of service of the data plane via chassis-cluster fabric traffic. Please refer to https://supportportal.juniper.net/JSA112186 [juniper.net] for more information.
PR NumberCategory: Firewall Policy
1939433
Major		On SRX devices operating in a High Availability cluster with logical-systems enabled, the backup node may display fewer flow sessions than the primary node due to incomplete flow session synchronization. Sessions that do not synchronize to the backup node are lost during a failover, resulting in service interruption for the affected flows.
PR NumberCategory: IPSEC/IKE VPN
1922601
Critical		An Improper Validation of Syntactic Correctness of Input vulnerability in the VPN daemon of Juniper Networks Junos OS on SRX Series allows an authenticated, network-based attacker to take complete control of the device. Please refer to https://supportportal.juniper.net/JSA112173 [juniper.net] for more information.
1951651
Critical		A Stack-based Buffer Overflow vulnerability in the iked IKE key-management daemon of Juniper Networks Junos OS on the SRX Series allows an authenticated remote-access VPN client to execute code with root privileges or cause denial of service via the remote-access VPN authentication and JIMS identity-publishing path. Please refer to https://supportportal.juniper.net/JSA112186 [juniper.net] for more information.
PR NumberCategory: Security platform jweb support
1725808
Critical		PHP software included with Juniper Networks Junos OS J-Web has been updated to resolve multiple vulnerabilities. Please refer to https://supportportal.juniper.net/JSA88120 [juniper.net] for more information.
1953101
Critical		An Improper Authentication vulnerability in the J-Web management interface and its NETCONF session handling of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to obtain root-level device configuration access and take over the device via a reachable J-Web HTTP or HTTPS service when web management is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1953328
Major		An Improper Authentication vulnerability in the J-Web web management component of Juniper Networks Junos OS allows an unauthenticated remote attacker to execute arbitrary Junos commands with root privileges via the exposed J-Web web interface. Please refer to https://supportportal.juniper.net/JSA112188 [juniper.net] for more information.
1954482
Critical		A Stack-based Buffer Overflow vulnerability in the httpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to cause remote code execution and denial of service via a J-Web virtual-domain configured. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954503
Major		An Improper Authentication vulnerability in J-Web of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to bypass J-Web authentication and execute CGI content with elevated privileges via a crafted HTTP request. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: Key Management Daemon
1952216
Critical		A Stack-based Buffer Overflow vulnerability in the kmd component of Juniper Networks Junos OS on MX Series allows an unauthenticated network attacker to execute code as root via specific IKE certificate-based packets. Please refer to https://supportportal.juniper.net/JSA112196 [juniper.net] for more information.
PR NumberCategory: Layer 2 Control Module
1957359
Critical		An Improper Validation of Consistency within Input vulnerability in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated Layer 2 attacker to cause a denial of service in associated Layer 2 control protocols via a crafted MVRP Ethernet frame sent to an MVRP-enabled interface. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1957361
Critical		An Allocation of Resources Without Limits or Throttling vulnerability in the l2cpd process of Juniper Networks Junos OS allows an adjacent unauthenticated attacker to cause a denial of service and l2cpd restart via FNP-enabled Layer 2 interfaces. The issue is triggered when the FNP feature is enabled on a VPLS routing instance with VLAN-VPLS encapsulation enabled. Please refer to https://supportportal.juniper.net/JSA112188 [juniper.net] for more information.
1957363
Critical		A Stack-based Buffer Overflow vulnerability in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service or execute arbitrary code with root privileges via LLDP traffic received on an interface with Unified Access Policy enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1957368
Critical		A Stack-based Buffer Overflow vulnerability in the l2cpd daemon of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service in Layer 2 control-plane processing via LLDP packets received on an interface configured for LLDP. Repeated triggering may disrupt LLDP and other Layer 2 control protocols across the device. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1957373
Critical		An Improper Release of Memory Before Removing Last Reference vulnerability in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved platforms allows an adjacent unauthenticated attacker to cause l2cpd memory exhaustion and Layer 2 control-plane disruption via LLDP traffic when fast receive processing is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: Layer2 forwarding on EX/NFX/PTX/QFX
1956577
Critical		A Missing Release of Memory after Effective Lifetime vulnerability in the l2ald process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via crafted packets when the static MAC-IP feature is in use. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956583
Critical		A Reachable Assertion vulnerability in l2ald of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause a denial of service via an ICCP peer message when MC-LAG IRB MAC synchronization is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956599
Critical		An Integer Overflow or Wraparound vulnerability in the l2ald process of Juniper Networks Junos OS and Junos OS Evolved allows a configured EVPN BGP peer to cause a denial of service via EVPN Type-2 MAC/IP routes. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1957705
Critical		An Improper Release of Memory Before Removing Last Reference vulnerability in the l2ald process of Juniper Networks Junos OS and Junos OS Evolved on QFX5K-family platforms allows a configured EVPN peer to cause a denial of service through memory exhaustion via EVPN-VXLAN active-active multihoming route processing. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1957710
Critical		An Improper Handling of Length Parameter Inconsistency vulnerability in L2ALM of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to obtain stale PFE packet memory via VXLAN overlay-ping traffic sent to a local VTEP. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: lacp protocol
1956919
Critical		An Out-of-bounds Write vulnerability in lacpd of Juniper Networks Junos OS Evolved allows a Layer-2-adjacent attacker to cause a denial of service via a crafted frame received on an LACP-enabled aggregated-Ethernet member port. Please refer to https://supportportal.juniper.net/JSA112250 [juniper.net] for more information.
PR NumberCategory: Label Distribution Protocol
1954119
Critical		A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos EVO allows an adjacent attacker to cause a denial of service via an established LDP session carrying an IPv6 Prefix FEC in a specific Label message. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954120
Critical		A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos EVO allows an adjacent unauthenticated attacker to cause a denial of service via LDP control traffic. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954127
Critical		A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos EVO allows an adjacent attacker to cause a denial of service via an established LDP session when two misconfigured neighbors (or one neighbor duplicated by an L2 loop) advertise the same transport address on a link-protected interface. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: JDHCP is a daemon for EVO platform to handle DHCP protocol
1957664
Critical		A Stack-based Buffer Overflow vulnerability in the jdhcpd process of Juniper Networks Junos OS and Junos OS Evolved platforms allows an adjacent unauthenticated attacker to cause denial of service or execute arbitrary code with root privileges via a malformed DHCPv4 server response when the DHCPv4 local-client feature is used. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1957862
Critical		A Stack-based Buffer Overflow vulnerability in the jdhcpd process of Juniper Networks Junos OS allows an unauthenticated adjacent attacker to cause a denial of service via a DHCP client response. The issue affects DHCP client operation and can interrupt related DHCP, relay, and zero-touch-provisioning services. Please refer to https://supportportal.juniper.net/JSA112188 [juniper.net] for more information.
PR NumberCategory: mc-ae interface
1954885
Major		An Improper Handling of Length Parameter Inconsistency vulnerability in the l2ald daemon of Juniper Networks Junos OS and Junos OS Evolved allows an attacker who can control or impersonate a configured MC-LAG ICCP peer to disclose process heap memory or cause a denial of service via a malformed ICCP message. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954888
Major		An Improper Validation of Specified Quantity in Input vulnerability in the l2ald of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker with access to an ICCP peer session to cause memory disclosure and disruption of the l2ald daemon via malformed ICCP packets. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954889
Major		A Reachable Assertion vulnerability in the l2ald daemon of Juniper Networks Junos OS and Junos OS Evolved devices configured for MC-LAG/ICCP allows an adjacent attacker to cause a denial of service via an inconsistent ICCP peer message. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956578
Critical		An Improper Validation of Specified Quantity in Input vulnerability in l2ald of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause a denial of service via an ICCP MC-LAG message. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956580
Critical		A Reachable Assertion vulnerability in the l2ald daemon of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured ICCP peer to cause a denial of service via a malformed MC-LAG message. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: Multiprotocol Label Switching
1956673
Critical		A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP-LS peer to cause a denial of service via a BGP-LS update. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: Multicast for L3VPNs
1953081
Critical		An Improper Validation of Consistency within Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-adjacent configured BGP peer to cause a denial of service by sending a specifically malformed BGP MCAST-TREE update and this NLRI is then attempted to be readvertised. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954493
Major		A Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS Evolved on PTX Series allows an unauthenticated IS-IS peer to cause a denial of service. Please refer to https://supportportal.juniper.net/JSA112250 [juniper.net] for more information.
1955224
Major		A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker to cause rpd crash via malformed BGP MCAST-VPN updates from a configured eBGP peer. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956148
Critical		An Improper Validation of Specified Quantity in Input vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP MVPN peer to cause a denial of service via a BGP MVPN signaling update. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956262
Critical		An Incomplete Cleanup vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a configured MVPN neighbor to cause a denial of service via a BGP MVPN update when an interregion segmented VRF with 'protocols mvpn inter-region-template' is configured. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: ISO network family related
1954427
Critical		An Integer Underflow vulnerability in the kernel of Juniper Networks Junos OS with Extended Echo configured allows an unauthenticated, network-based attacker to cause a denial of service by a kernel crash. Please refer to https://supportportal.juniper.net/JSA112188 [juniper.net] for more information.
PR NumberCategory: SCTP kernel issues
1957225
Critical		A Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in netsctp.ko of Juniper Networks Junos OS on MX Series allows an unauthenticated network attacker to cause a denial of service via crafted SCTP network traffic. Please refer to https://supportportal.juniper.net/JSA112196 [juniper.net] for more information.
PR NumberCategory: OSPF routing protocol
1951247
Critical		An Integer Overflow or Wraparound vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via specific OSPFv2 packets sent on an OSPF-enabled interface. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1951273
Critical		An Improper Validation of Specified Quantity in Input vulnerability in rpd of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent OSPF peer to disclose rpd memory or cause a rpd crash via a malformed OSPF packets. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1951277
Critical		A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent OSPF peer to cause a denial of service via OSPF traffic processed while OSPF Source Packet Routing best-route Prefix-SID installation is configured. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1958211
Critical		An Allocation of Resources Without Limits or Throttling vulnerability in rpd, the routing protocol daemon, of Juniper Networks Junos OS and Junos OS Evolved platforms allows an unauthenticated adjacent attacker to cause a denial of service and heap memory corruption via OSPFv3 messages on an enabled broadcast interface. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: Used for tracking OVSDB software issues and features
1950782
Critical		A Heap-based Buffer Overflow vulnerability in the VXLAN Gateway Daemon (vgd) of Juniper Networks Junos OS allows a malicious or compromised SDN-controller to cause a complete outage of the OVSDB control plane and possibly remote code execution. Please refer to https://supportportal.juniper.net/JSA112188 [juniper.net] for more information.
PR NumberCategory: MPLS Point-to-Multipoint TE
1954123
Major		A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause an rpd crash via a crafted LDP packet received over an established LDP session. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954449
Major		A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent LDP peer to cause an rpd crash or execute arbitrary code via a malformed LDP Label Mapping message. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954545
Major		A NULL Pointer Dereference vulnerability in the routing protcol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via LDP messages received over an operational LDP session. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954547
Major		A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a compromised LDP neighbor to cause an rpd crash via a crafted LDP message. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: Phone-Home-Client Infrastructure
1954221
Critical		An OS Command Injection vulnerability in the bootzd zero-touch provisioning daemon of Juniper Networks Junos OS Evolved allows an unauthenticated attacker on the management LAN to execute commands as root via crafted DHCP response if the management-instance configuration enabled. Please refer to https://supportportal.juniper.net/JSA112250 [juniper.net] for more information.
1954222
Critical		An OS Command Injection vulnerability in the bootzd zero-touch provisioning daemon of Juniper Networks Junos OS Evolved allows an unauthenticated attacker on the management LAN to execute commands as root via a crafted gRPC response. Please refer to https://supportportal.juniper.net/JSA112250 [juniper.net] for more information.
1958116
Critical		An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the phone-home daemon (phcd) of Juniper Networks Junos OS and Junos OS Evolved on EX Series, SRX Series, and QFX Series allows an adjacent unauthenticated attacker to execute arbitrary commands with root privileges via a rogue DHCP server. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1958129
Major		A Stack-based Buffer Overflow vulnerability in the phone-home daemon (phcd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to execute arbitrary code as root via a crafted DHCP SZTP bootstrap message. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: Protocol Independant Multicast
1956154
Critical		An Out-of-bounds Write vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated attacker to cause a routing-plane denial of service via Auto-RP mapping announcements received when Auto-RP mapping is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956156
Critical		A NULL Pointer Dereference vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial-of-service condition via a malformed PIM Bidir message. Refer to https://supportportal.juniper.net/JSA112187 [juniper.net]
1958191
Critical		An Improper Input Validation vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via a malformed PIM Hello message received on an IPv6-enabled PIM interface. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1958197
Critical		A Use After Free vulnerability in the rpd PIM Join/Prune processing of Juniper Networks Junos OS and Junos OS Evolved platforms allows an unauthenticated adjacent attacker to crash the routing daemon via specific PIM messages when sparse mode PIM is configured. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: Issues related to PKI daemon
1951251
Major		A NULL Pointer Dereference vulnerability in the pkid component of Juniper Networks Junos OS allows an unauthenticated remote attacker to cause a denial of service via a malformed packet received during CMP enrollment or automatic certificate re-enrollment. Please refer to https://supportportal.juniper.net/JSA112188 [juniper.net] for more information.
PR NumberCategory: QFX EVPN / VxLAN
1933698
Major		On Junos QFX5110, QFX5120, EX4650, EX4400, EX4100, and EX5200 platforms, when operating with EVPN-VxLAN type5 overlay ECMP at high tunnel next hop scale, the Packet Forwarding Engine (PFE) crash when a memory corruption issue is observed due to a buffer overflow that leads to corruption of heap management structures. This corrupted metadata is detected by the memory manager when later heap allocation or free operations are invoked, resulting in a reported heap corruption condition.
PR NumberCategory: Routing Information Protocol
1956181
Critical		An Improper Validation of Specified Quantity in Input vulnerability in the rpd process of Juniper Networks Junos OS and Junos Evolved allows an unauthenticated adjacent attacker to cause a denial-of-service condition via a malformed RIPv2 message. Refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: rosen-6 and rosen-7 mvpn bugs
1958185
Major		An Integer Underflow (Wrap or Wraparound) vulnerability in the rpd process of Juniper Networks Junos OS on EX Series and MX Series, and Junos OS Evolved on ACX Series allows an unauthenticated adjacent attacker to cause heap memory disclosure and multicast join-state injection via a malformed Rosen-MVPN message. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: Issues related to dynamic-tunnels routing infrastructure
1955227
Major		An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated BGP peer to cause an rpd crash via a malformed BGP-signaled SRv6 service route when SRv6 dynamic tunnels are enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: RPD Next-hop issues including indirect, CNH, and MCNH
1955220
Minor		A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos on MX Series routers allows an unauthenticated network attacker to cause a denial of service via an eBGP route update when HFRR link protection is configured in a VRF. Please refer to https://supportportal.juniper.net/JSA112196 [juniper.net] for more information.
PR NumberCategory: RPD policy options
1953062
Critical		A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP peer to cause a persistent routing-daemon denial of service via a specific BGP packet when ephemeral configuration is used. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1953064
Critical		A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated BGP peer to cause a denial of service via a specific BGP FlowSpec update received by an affected BGP session. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1953954
Critical		A NULL Pointer Dereference vulnerability in the routing protocol daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows a configured peer sending a BGP UPDATE to cause a denial of service when an import policy with `then source-based-forwarding next-hop next-table ` is configured to reference a routing table that does not exist. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1953965
Critical		A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP neighbor to cause a denial of service via a BGP route update when specific routing-policy resolution-map and policy event-tracing configuration is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: Issues related route resolution routing infrastructure
1956239
Critical		An Incorrect Calculation of Buffer Size vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP neighbor to cause an rpd crash via BGP labeled-unicast UPDATEs when the affected multipath features are enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: RPD route tables, resolver, routing instances, static routes
1956233
Critical		An Integer Overflow or Wraparound vulnerability in the routing daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated BGP peer to cause a denial of service via BGP route updates when extended-nexthop-tunnel is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956235
Critical		A Mismatched Memory Management Routines vulnerability in the routing protocol daemon (rpd) process of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated network-based attacker to cause a denial of service via a BGP route update when extended next-hop tunneling and SRv6 service processing are used. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: multicast source distribution protocol
1956260
Critical		A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated configured MSDP peer or adjacent PIM sender to cause a denial of service via an MSDP or PIM policy that uses AS-path expansion. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: Resource Reservation Protocol
1955230
Critical		A Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service via a malformed RSVP packet when RSVP is enabled on the receiving interface. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1955500
Major		An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service via a crafted RSVP packet when L2 LSP support is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information
1956204
Critical		A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent network attacker to cause a denial of service via a crafted RSVP packet when MPLS-TE RSVP processing is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956651
Critical		A NULL Pointer Dereference vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause a denial of service via a malformed RSVP Path message received on an EVPL LMP control channel. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956653
Critical		A NULL Pointer Dereference vulnerability in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to crash the routing daemon and cause a denial of service via an RSVP Path message. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956659
Critical		A Reachable Assertion vulnerability in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated network attacker to cause a denial of service via malformed RSVP signaling when RSVP is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956663
Critical		A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to crash the routing process via RSVP-TE associated-bidirectional LSP signaling. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1962883
Major		A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via a specific RSVP packet. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: RPM and TWAMP
1958232
Major		A Reachable Assertion vulnerability in the Two-Way Active Measurement Protocol (TWAMP) client of Juniper Networks Junos OS allows an unauthenticated network-based attacker to cause rmopd service disruption via a specific TCP packet. Please refer to https://supportportal.juniper.net/JSA112188 [juniper.net] for more information
PR NumberCategory: SNMP Infrastructure (snmpd, mib2d)
1954250
Critical		A Stack-based Buffer Overflow vulnerability in the authd Juniper Networks Junos OS and Junos OS Evolved allows a network attacker with SNMP read access to execute code with root privileges or cause a denial of service via a specific SNMP packet, when SNMP and AAA are enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: Segment routing traffic Engineering
1956205
Critical		A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP-LS peer to cause an rpd crash via a crafted BGP-LS Link NLRI advertisements. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: SRX Advanced Anti-Malware module
1955171
Major		An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ipfd of Juniper Networks Junos OS on SRX Series allows an unauthenticated network-based attacker to execute code with root privileges via a configured Security Intelligence feed connection. Please refer to https://supportportal.juniper.net/JSA112186 [juniper.net] for more information.
1955172
Major		An Use of Externally-Controlled Format String vulnerability in the ipfd daemon of Juniper Networks Junos OS on SRX Series allows an unauthenticated network-based attacker to execute code with root privileges via a compromised or impersonated configured HTTPS feed server. Please refer to https://supportportal.juniper.net/JSA112186 [juniper.net] for more information
PR NumberCategory: SRX branch platforms
1924464
Minor		On all branch SRX platforms (SRX300/320/340/345/380) running on FreeBSD12 OS, any upgrade post 24.4 release will cause a delay in every CLI (Command Line Interface) commit, with no impact to traffic forwarding or network services.
1943202
Minor		On all Junos OS and Junos OS Evolved platforms, when copying a file to a remote host using a hostname, the device is unable to resolve the hostname, causing the file transfer to fail. Secure Copy (SCP) operations are not affected and continue to work as expected. This issue does not impact network services or device functionality.
PR NumberCategory: ZT/YT pfe infra issues
1882470
Major		On MX304, MX301 and MX10K with LC4800 or LC9600 platforms, when the st0 interface is a part of ECMP (Equal-Cost Multi-Path) next-hop, the next hop corresponding to st0 interface will not be selected for traffic forwarding, because st0 will be marked as down resulting in functionality impact of ECMP. However, if there is a non-st0 as a backup link, this link will be selected for traffic forwarding. This doesn't impact IPSec traffic forwarded on this st0 interface.
PR NumberCategory: N/A:sw-trinity-pfe-inline-map:
1912053
Major		An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS on MX Series allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS). Please refer to https://supportportal.juniper.net/JSA110079 [juniper.net] for more details.
PR NumberCategory: Trio pfe l3 forwarding issues
1902535
Major		An Unchecked Input for Loop Condition vulnerability in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS on MX Series allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS). Please refer to https://supportportal.juniper.net/JSA110075 [juniper.net] for more details.
PR NumberCategory: Junos Automation, Commit/Op/Event and SLAX
1960476
Major		Event script failure occurs during a virtual chassis primary role change when the system is unable to load a required component at the time the script is executed.
PR NumberCategory: UI Infrastructure - mgd, DAX API, DDL/ODL
1947196
Minor		Resolved an issue where configuration commits could intermittently fail when applying certain routing policy changes. The problem occurred only under specific conditions during commit processing and could result in the commit operation aborting unexpectedly. This fix improves commit stability when updating routing policies.
1948232
Major		On Junos OS and Junos OS Evolved platforms with virtual chassis (VC) deployments when the CLI command 'test configuration ' is executed it fails consistently and error messages are observed.
1951668
Critical		A Heap-based Buffer Overflow vulnerability in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated attacker who can control or intercept the configured SDX/SRC server connection to execute code as root or cause denial of service via a crafted frame received over the service-deployment TCP connection. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: Issues related to Logging/Tracing, errmsg, eventd infrastruc
1953674
Critical		A Heap-based Buffer Overflow vulnerability in eventd of Juniper Networks Junos OS and Junos OS Evolved on all platforms allows an unprivileged local attacker to cause a denial of service (DoS) or achieve privilege escalation to root via crafted IPC event messages. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: Issues related to NETCONF
1894296
Major		On Junos Evolved platforms, a gNMI Get request for the OpenConfig root (origin: openconfig, type CONFIG) returns a NOT_FOUND error when only root-level OpenConfig metadata is configured and no OpenConfig configuration data nodes are present. In this scenario, the configured OpenConfig metadata is not returned unless at least one OpenConfig configuration subtree exists.
PR NumberCategory: anti spam bugs
1952922
Major		On SRX platforms, upgrading from Junos OS releases later than 22.2 but earlier than 24.4 causes Internet Protocol Security (IPsec) Virtual Private Network (VPN) renegotiation during the first configuration commit after reboot. Existing Internet Protocol Security (IPsec) VPN tunnels briefly disconnect and reconnect because retained Unified Threat Management (UTM) runtime warning data created by earlier software releases is processed differently by newer software versions. VPN traffic recovers automatically after renegotiation, and subsequent commits are not impacted.
1953149
Critical		A Stack-based Buffer Overflow vulnerability in the UTM Anti-Spam SBL of Juniper Networks Junos OS on SRX series allows an unauthenticated remote attacker to cause arbitrary code execution or a denial of service via a injected malformed DNS packet when Anti-Spam SBL inspection is enabled.Please refer to the https://supportportal.juniper.net/JSA112186 [juniper.net] for more information.
PR NumberCategory: web filterig issues
1923041
Major		An Improper Resource Locking vulnerability in the UTM processing of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). Please refer to https://supportportal.juniper.net/JSA112174 [juniper.net] for more information.
1956639
Critical		An XML Injection vulnerability in the Unified Threat Management daemon (utmd) of Juniper Networks Junos OS on SRX Series devices allows an unauthenticated network attacker to commit arbitrary device configuration with root priviledges via a malicious response from a configured custom URL-feed server. Please refer to https://supportportal.juniper.net/JSA112186 [juniper.net] for more information.
PR NumberCategory: MX10K linecard
1954671
Major		On MX10004 and MX10008 platforms, a rare timingd internal event-processing issue prevent PTP (Precision Time Protocol) synchronization from initializing successfully. When this condition occurs, PTP remains in the initializing state, PTP packet processing does not occur, and PTP Rx/Tx statistics remain at zero despite valid configuration and operational SyncE/ESMC (Ethernet Synchronization Messaging Channel) synchronization. The timingd process continues running, but internal timing events are no longer processed correctly, resulting in loss of PTP functionality until service recovery actions are performed. This issue does not impact normal data forwarding traffic and is limited to PTP operation.
PR NumberCategory: Virtual Private LAN Services
1954879
Major		An Improper Input Validation vulnerability in the routing protocol daemon (rpd) process of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP peer to cause an rpd crash via a BGP VPLS signaling update. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954880
Major		A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent eBGP peer to cause a denial of service via a VPLS signaling update when automatic site-ID negotiation is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956248
Critical		A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote BGP peer to cause a denial of service when multiple UPDATEs occur over a single TCP session with 'bgp family l2vpn auto-discovery-only' configured. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberCategory: usf flow and datapath issue on SPC3
1925039
Major		On Junos OS MX240/MX480/MX960 platforms with MX-SPC3 cards, the flowd process crash and reboots the service PIC when a stale IPv4 session is mistakenly reused for IPv6 due to a memory issue. During process restart the services remain down, session information is briefly lost and active traffic will drop, however the system recovers automatically.

 

Extended Solution

25.4R1-S3 - List of Known issues

PR NumberSynopsisCategory: NSD process
1975351
Major		The nsd process unexpectedly crashes and restarts under heavy DNS-based address-book churn
Product-Group=junos		On SRX Series devices running the 32-bit Network Security Daemon (nsd) with security policies referencing large numbers of Fully Qualified Domain Name (FQDN) (dns-name) address-book objects, continuous high-frequency Domain Name System (DNS) activity causes memory exhaustion within the process over time. Once memory is depleted, the nsd process terminates unexpectedly with a crash and restarts.

Resolved In: evo:25.4R2-EVO evo:26.2R2-EVO evo:26.4R1-EVO evo:27.1R1-EVO junos:25.4R2 junos:26.2R2 junos:26.4R1
PR NumberSynopsisCategory: "agentd" software daemon
1923848
Major		Junos Evolved platfrom, when gNMI collecting data from "optics/lanediags/lane/lane_laser_receiver_power_dbm" and "optics/lanediags/lane/lane_laser_output_power_dbm" are unreadable
Product-Group=junos		The JavaScript Object Notation (JSON) encoding of leafs of type "ieeefloat32"(https://github.com/openconfig/public/blob/master/release/models/types/openconfig-types.yang#L127) is not correct, causing gRPC Network Management Interface (gNMI) data outputs unreadable.

Resolved In: evo:22.3X80-D49-EVO evo:24.2R2-S6-EVO evo:24.4R2-S4-EVO evo:25.2R2-S2-EVO evo:25.4R2-EVO evo:26.2R1-EVO junos:24.2R2-S6 junos:25.2R2-S2 junos:25.4R1-S2-J11 junos:25.4R2 junos:26.2R1
PR NumberSynopsisCategory: BBE Resource monitoring related issues
1942159
Major		New subscriber login request failure is seen due to missing PFE readiness update after boot
Product-Group=junos		On MX240, MX480, MX960, MX2008, MX2010, MX2020 platforms with MPC2/3/4/5/6/7/8/9 line cards, the new subscriber login request will fail if subscriber login request is initiated when PFE (Packet Forwarding Engine) is booting.

Resolved In: evo:25.4R2-EVO evo:26.2R1-EVO evo:26.3R1-EVO junos:23.2R2-S8 junos:24.2R2-S6 junos:24.4R2-S4-J7 junos:24.4R2-S4-J8 junos:24.4R2-S5-J12 junos:25.2R2-S2 junos:25.4R2 junos:26.2R1 junos:26.3R1
PR NumberSynopsisCategory: Border Gateway Protocol
1933049
Critical		Junos OS and Junos OS Evolved: If a specific set of BGP communities is present and graceful-shutdown sender is added while attempting to advertise rpd crashes (CVE-2026-103993)
Product-Group=junos		An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker which sends a specific set of BGP communities to cause a Denial-of-Service (DoS) as rpd crashes when graceful-shutdown sender community is added when attempting to advertise. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.

Resolved In: evo:22.3X50-EVO evo:22.3X50-J5-EVO evo:22.3X80-D49-EVO evo:23.2R2-S7-EVO evo:23.4R2-S8-EVO evo:24.2R2-S5-EVO evo:24.4R2-S4-EVO evo:25.2R2-S1-EVO evo:25.2X100-D35-EVO evo:25.2X100-EVO evo:25.4R1-S2-EVO evo:25.4R2-EVO evo:25.4X300-EVO evo:26.1R1-EVO evo:26.2R1-EVO evo:26.3R1-EVO junos:20.3X75-D443 junos:20.3X75-D52-J3 junos:21.2R3-S11 junos:21.2X33 junos:21.2X34 junos:21.4R3-S12 junos:21.4R3-S12-X1 junos:21.4R3-S13 junos:22.2R3-S8 junos:22.3R3-S5 junos:22.3X60-J4 junos:22.4R3-S10 junos:22.4R3-S9 junos:22.4X50 junos:23.2R2-S7 junos:23.4R2-S8 junos:24.2R2-S5 junos:24.4R2-S4 junos:25.2R2-S1 junos:25.4R1-S2 junos:25.4R2 junos:26.1R1 junos:26.2R1
1957642
Major		Incorrect VRF label allocation for IPv4 L3VPN routes with RIB-Export leading to unexpected forwarding behaviour
Product-Group=junos		On all Junos and Junos Evolved platforms, IPv4 (Internet Protocol version 4) VPN (Virtual Private Network) routes in a VRF (Virtual Routing and Forwarding instance) will be advertised with per-next-hop label, while IPv6 (Internet Protocol version 6) VPN routes in the same VRF correctly advertise VRF table-label. Under these combined conditions, IPv4 VPN routes are assigned per-next-hop labels instead of using a single shared VRF table-label, resulting in undesirable forwarding behaviour for IPv4 VPN routes.

Resolved In: evo:25.4R2-EVO evo:26.2R2-EVO evo:26.3R1-EVO junos:25.2R2-J2 junos:25.2R2-S1-J13 junos:25.2R2-S2-J2 junos:25.2R2-S2-J7 junos:25.4R2 junos:26.2R2 junos:26.3R1
PR NumberSynopsisCategory: MX304 line card platform software
1948157
Major		PFE disabled due to FIFO overflow
Product-Group=junos		On Junos OS MX304 and MX10004/MX10008 routers with Line Card (LC) LC4800/LC9600, the Packet Forwarding Engine (PFE) gets disabled. When the Logical Unified Scheduler Subsystem (LUSS) Packet Processing Engines (PPEs) were busy, the On-Chip Gigabit Ethernet (OGE) traffic was starved for an extended duration, which resulted in a First-In-First-Out (FIFO) buffer overflow. If traffic is flowing while the Flexible PIC Concentrator (FPC) is coming online, a FIFO overflow interrupt is triggered, which causes the PFE to be disabled.

Resolved In: evo:25.4R2-EVO evo:26.2R1-EVO evo:26.2R2-EVO evo:26.3R1-EVO evo:26.4R1-EVO junos:24.2R2-S6 junos:24.4R2-S3-J4 junos:24.4R2-S4-J17 junos:24.4R2-S4-J6 junos:24.4R2-S5 junos:24.4R2-S6 junos:24.4X3 junos:25.4R1-S2-J10 junos:25.4R2 junos:25.4R2-S2 junos:26.2R1 junos:26.2R2 junos:26.4R1
PR NumberSynopsisCategory: MX304 Routing Engine issues
1913540
Minor		[MX304] Certain 'cat' commands within the 'show vmhost support-info' command in RSI try to access files that are not present on the MX304, causing error messages to appear.
Product-Group=junos		As part of the RSI process, execute the "show vmhost support-info" command to comprehensively collect the vmhost logs using various cat commands. Some of these commands attempt to access files that do not exist on the MX304, leading to error messages.

Resolved In: junos:21.2R3-S11 junos:22.4X50 junos:24.2R2-S5 junos:25.2R2-S1 junos:25.4R2 junos:26.1R1
1945622
Minor		On MX304 platforms, error logs are seen after reboot, due to a missing file presence check
Product-Group=junos		On MX304 platforms, repeated error messages are observed in Linux (jncl) logs after a reboot. The issue occurs when a shell script attempts to read the non-existent sysfs file: cat: /sys/devices/virtual/net/macvtap0/statistics/rx_errors There is no traffic or service impact.

Resolved In: junos:23.4X14 junos:23.4X18 junos:23.4X51 junos:25.2X31 junos:25.4R2 junos:26.3DCB junos:26.3R1
PR NumberSynopsisCategory: QFX Control Plane VXLAN
1926468
Major		EVPN-VXLAN: Duplicate Proxied Neighbor Advertisements Missing Router/Override Flags Disrupt IPv6 Connectivity
Product-Group=junos		When Junos and Junos Evolved platform sends two proxied Neighbor Advertisement for default gateway, second one without Router flag and target Link-Layer address. The second Neighbor Advertisement can disrupt connectivity for end hosts. A proxied Neighbor Advertisement (NA) is an IPv6 mechanism where a network device responds to Neighbor Discovery requests on behalf of another device, instead of the actual endpoint replying itself.

Resolved In: evo:24.2R2-S6-EVO evo:25.2R2-S2-EVO evo:25.4R2-EVO evo:26.3R1-EVO evo:26.4R1-EVO junos:23.4R2-S8 junos:24.2R2-S6 junos:24.4R2-S5 junos:24.4R2-S6 junos:25.2R2-S2 junos:25.4R2 junos:26.2R1
PR NumberSynopsisCategory: JDM issues in CSDS solution
1914935
Critical		Junos OS: MX Series: Missing Authorization for specific 'request' CLI commands in a JDM/CSDS scenario (CVE-2026-33785)
Product-Group=junos		A Missing Authorization vulnerability in the CLI of Juniper Networks Junos OS on MX Series allows a local, authenticated user with low privileges to execute specific commands which will lead to a complete compromise of managed devices. Please refer to https://supportportal.juniper.net/JSA107872 [juniper.net] for more information.

Resolved In: evo:25.4R1-EVO evo:26.1R1-EVO junos:24.4R2-S3 junos:25.2R2 junos:25.4R1 junos:25.4R2 junos:26.1R1 junos:26.3R1 junos:26.4R1
PR NumberSynopsisCategory: Firewall Filter
1951120
Major		Traffic drops observed on MX304 due to LMIC restart/swap causing policer address collision across PFE partitions
Product-Group=junos		On MX304 platforms, when an LMIC (Line-Card Module Interface Card) restart/swap occurs and firewall filters with interface or ARP (Address Resolution Protocol) policers are applied across interfaces belonging to two different LMICs, a policer address collision across PFE (Packet Forwarding Engine) partitions occurs, leading to discard filter installation and resulting in traffic drops until the FPC (Flexible PIC Concentrator) is restarted to restore normal forwarding.

Resolved In: evo:25.4R2-EVO evo:26.2R2-EVO evo:26.3R1-EVO junos:24.4R2-S4-J6 junos:25.2R2-S2 junos:25.4R2 junos:25.4R2-S1 junos:26.2R1 junos:26.2R2 junos:26.3R1
PR NumberSynopsisCategory: EVO Class of Services
1930528
Major		dscp-code-point under host-outbound-traffic is not enabled on PTX
Product-Group=junos		set class-of-service host-outbound-traffic dscp-code-point was disabled on PTX in 25.4R1. Later it was enabled in 26.2R1 and backported to 25.4R2

Resolved In: evo:25.4R1-S3-EVO evo:25.4R2-EVO evo:26.2R1-EVO junos:25.4R2 junos:26.2R1
PR NumberSynopsisCategory: EVPN control plane issues
1952492
Critical		Junos OS and Junos OS Evolved: A malformed EVPN SRv6 route causes an rpd crash (CVE-2026-102184)
Product-Group=junos		An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos Evolved platforms allows a configured EVPN signaling peer to cause an rpd crash via a malformed SRv6 structure carried in an EVPN route update. The result is a denial of service affecting routing adjacencies. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.

Resolved In: evo:24.2R2-S5-EVO evo:24.4R2-S5-EVO evo:25.2R2-S2-EVO evo:25.2X100-D35-EVO evo:25.4R1-S3-EVO evo:25.4R2-EVO evo:25.4X300-EVO evo:26.2R2-EVO evo:26.2X200-D10-EVO evo:26.2X200-EVO evo:26.3R1-EVO junos:23.4R2-S8 junos:24.2R2-S5 junos:24.2R2-S6 junos:24.4R2-S5 junos:25.2R2-S2 junos:25.4R2 junos:26.2R1-S2 junos:26.2R2 junos:26.3R1
PR NumberSynopsisCategory: EVPN Layer-2 Forwarding
1943641
Major		ARP and MAC/IP table for virtual IP mac is not installed in bridge domain which is part if EVPN instance
Product-Group=junos		In all Junos and Junos OS Evolved platforms supporting EVPN-MPLS, EVPN-VXLAN when VRRP device is connected to EVPN PE with Aggregate Ethernet interface the VRRP virtual IP may fail to install ARP and destination route entries when the VRRP virtual MAC is learned on one FPC while the ARP response is received on another FPC with a source MAC mismatch.

Resolved In: evo:23.4R2-S8-EVO evo:24.2R2-S6-EVO evo:25.2R2-S2-EVO evo:25.4R2-EVO evo:26.2R1-EVO evo:26.3R1-EVO junos:22.2R3-S8 junos:23.4R2-S8 junos:23.4R2-S9 junos:24.2R2-S6 junos:25.2R2-S2 junos:25.4R2 junos:26.2R1 junos:26.3R1
1947816
Major		IP allocation failure in EVPN-MPLS/VXLAN environments due to incorrect Proxy ARP responses
Product-Group=junos		On all Junos OS and Junos OS Evolved platforms running a release from 25.4R1 in an EVPN (Ethernet Virtual Private Network)-MPLS (Multiprotocol Label Switching ) or EVPN-VXLAN (Virtual Extensible Local Area Network) environment, with an IRB (Integrated Routing and Bridging) interface configured as the Layer 3 gateway, when ARP (Address Resolution Protocol) probe packets are received while proxy ARP is enabled, the device generates proxy ARP replies for unresolved IP (Internet Protocol) addresses. This causes false duplicate IP detection and leads to DHCP (Dynamic Host Configuration Protocol) address assignment failure.

Resolved In: evo:25.4R2-EVO evo:26.2R1-EVO evo:26.2R2-EVO evo:26.3R1-EVO junos:25.4R2 junos:25.4R2-S1 junos:26.2R1 junos:26.2R2 junos:26.3R1
PR NumberSynopsisCategory: EX interfaces issues
1492605
Minor		runt, fragment and jabber counters are not incrementing on EX4300-MPs
Product-Group=junos		runt, fragment and jabber counters are not incrementing on EX4300-MPs

Resolved In:
PR NumberSynopsisCategory: EX POE
1930080
Minor		PoE outage observed on EX4400 in a rare scenario
Product-Group=junosvae		On EX4400 platforms, loss of PoE (Power over Ethernet) power is seen on ports after port bounce or even during normal operation without specific external trigger . This causes outage on all PoE ports and devices connected to PoE port will not receive power causing service impact.

Resolved In: evo:25.4R2-EVO evo:26.2R1-EVO evo:26.3R1-EVO junos:23.2R2-S8 junos:23.4R2-S8 junos:24.2R2-S5 junos:24.4R2-S4 junos:25.2R2-S1 junos:25.4R1-S2 junos:25.4R2 junos:26.1R1 junos:26.2R1 junos:26.3R1
PR NumberSynopsisCategory: Express PFE including evpn, vxlan
1952451
Major		The dcpfe process crash is seen on QFX10002-60C platforms during high frequency route churn
Product-Group=junos		On QFX10002-60C platforms in an Ethernet Virtual Private Network (EVPN) Virtual Extensible Local Area Network (VxLAN) setup, the dcpfe process crash is seen, causing the Flexible PIC Concentrator (FPC) to restart and thus impacts forwarding traffic. This is a rare occurrence when Layer 3 traffic is forwarded through an EVPN VxLAN type-5 tunnel and continuous route churn (route add/delete operations) is in progress.

Resolved In: junos:23.2R2-S8 junos:24.2R2-S6
PR NumberSynopsisCategory: Express PFE L2 fwding Features
1916949
Major		Junos OS: QFX10000 Series: IPv6 multicast traffic received on non-IRB interfaces causes a multicast flood (CVE-2026-57020)
Product-Group=junos		An Improper Check for Unusual or Exceptional Conditions vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on QFX10000 Series allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS). Please refer to https://supportportal.juniper.net/JSA110080 [juniper.net] for more information.

Resolved In: junos:22.2R3-S8 junos:22.3R3-S5 junos:23.2R2-S7 junos:23.4R2-S8 junos:24.2R2-S4 junos:24.4R2-S4
PR NumberSynopsisCategory: ISIS routing protocol
1937971
Major		LDP-IGP synchronization remains stuck in holddown state on ISIS multiinstance interfaces
Product-Group=junos		When the ldp-synchronization statement is configured under ISIS multiinstance interfaces, the router might fail to properly synchronize LDP (Label Distribution Protocol) with ISIS during adjacency establishment. As a result, the ISIS interface remains in the LDP synchronization holddown state, and the advertised ISIS metric is not updated as expected. This may lead to suboptimal routing or traffic forwarding inconsistencies.

Resolved In: evo:24.2R2-S5-EVO evo:25.2R2-S1-EVO evo:25.4R1-J2-EVO evo:25.4R2-EVO evo:26.2R1-EVO evo:26.3R1-EVO junos:23.2R2-S8 junos:24.2R2-S5 junos:25.2R2-S1 junos:25.4R2 junos:26.2R1 junos:26.3R1
PR NumberSynopsisCategory: jdhcpd daemon
1934742
Major		DHCPv6 Relay Active Leasequery not able to establish TCP session to peer
Product-Group=junos		On all MX platforms, when configuring Dual Stack DHCPv6 ALQ without configuring DHCPv4 ALQ (active-leasequery), the ALQ will not be able to establish the TCP (Transmission Control Protocol) session for the ALQ peer due to XID (Exchange Identification) mismatch. This can lead to DHCPv6 subscriber bindings sync issue and server ALQ, resulting in compromising the redundancy functionality.

Resolved In: evo:24.2R2-S6-EVO evo:25.2R2-S2-EVO junos:23.4R2-S7-J21 junos:24.2R2-S6 junos:25.2R2-S2 junos:25.4R2 junos:26.2R1 junos:26.3R1
1947179
Major		The dhcpd crash triggered by DHCPv6 ALQ peer state inconsistency
Product-Group=junos		On MX104, MX204, MX240, MX301, MX304, MX480, MX960, MX2008, MX2010, MX2020, MX10003, MX10004, MX10008 and MX10016 platforms DHCPv6 (Dynamic Host Configuration Protocol version 6) ALQ (Active Lease Query) peer state inconsistency creates an invalid subscriber entry for a bound IPv6 address, resulting in a jdhcpd (Junos DHCP daemon) crash with recurring core dumps and subscriber traffic impact.

Resolved In: evo:24.2R2-S6-EVO evo:25.2R2-S2-EVO evo:25.4R2-EVO evo:26.2R2-EVO evo:26.3R1-EVO junos:23.4R2-S8-J11 junos:23.4R2-S8-J5 junos:24.2R2-S3-J14 junos:24.2R2-S6 junos:24.4R2-S4-J5 junos:25.2R2-S2 junos:25.4R2 junos:25.4R2-S1 junos:26.2R2 junos:26.3R1 junos:26.4R1
PR NumberSynopsisCategory: Adresses ALG issues found in JSF
1930403
Major		SIP calls may not function properly in the SIP ALG application on MX-SPC3 and SRX platforms
Product-Group=junos		On MX platforms with SPC3 line-cards/ SRX platforms, when there are bandwidth attributes carried in SDP(Session Description Protocol) messages inside SIP(Session Initiation Protocol) packets, SIP application traffic and SIP calls get impacted.

Resolved In: junos:19.2R3-S12 junos:19.3R3-S13 junos:22.2R3-S8 junos:23.2R2-S8 junos:24.2R2-S6 junos:24.4R2-S4 junos:24.4R2-S6 junos:25.2R2 junos:25.4R2 junos:26.2R1 junos:26.3DCB junos:26.4DCB
PR NumberSynopsisCategory: Flow Module
1918795
Critical		Junos OS: MX Series with SPC3, SRX Series: A specifically malformed TCP packet causes a flowd crash (CVE-2026-57023)
Product-Group=junos		An Improper Validation of Specified Quantity in Input vulnerability in the TCP proxy plugin of Juniper Networks Junos OS on MX Series with SPC3, and SRX Series allows an unauthenticated, network-based attacker to cause a complete Denial of Service (DoS). Please refer to https://supportportal.juniper.net/JSA110083 [juniper.net] for more information.

Resolved In: junos:22.4R3-S9 junos:23.2R2-S1-J16 junos:23.2R2-S6 junos:23.4R2-S7 junos:24.2R2-S4 junos:24.4R2-J6 junos:24.4R2-S3 junos:25.2R2 junos:25.2R2-S1 junos:25.2R2-S2 junos:25.4R1 junos:25.4R2 junos:26.1R1 junos:26.4DCB
PR NumberSynopsisCategory: interfaces and zones for junos js software
1928131
Minor		MRU not updating when mtu is configured on SRX SFP28 pic with interface speed configuration
Product-Group=junos		On SRX1600/SRX2300/SRX4300 platforms, the Maximum Receive Unit (MRU) does not update correctly when a non-default Maximum Transmission Unit (MTU) value is configured on an interface belonging to an SFP28 Physical Interface Card (PIC) while port speed is explicitly configured at the interface level. Incorrect MRU programming results in packet size inconsistencies, which lead to traffic drops for packets exceeding the incorrectly programmed MRU value.

Resolved In: junos:24.2R2-S5 junos:25.2R2-S1 junos:25.4R2 junos:25.4R2-S1 junos:26.1R1 junos:26.2R1
PR NumberSynopsisCategory: Firewall Policy
1932245
Minor		NSD main thread delay during policy file serialization on SRX5K platforms leads to instability
Product-Group=junos		On SRX5K platforms, during policy configuration processing using the policy file serialization feature, the Network Security Daemon (NSD) main thread can stop yielding for more than one second. This results in warning messages in system logs and can impact protocol/FPC stability if the delay becomes excessive.

Resolved In: evo:25.4R2-EVO evo:26.2R1-EVO evo:26.3R1-EVO junos:24.4R2-S3-J5 junos:24.4R2-S4 junos:25.2R2-S1 junos:25.4R2 junos:26.2R1 junos:26.3R1
PR NumberSynopsisCategory: Security platform jweb support
1962290
Major		SRX400 Series J-Web does not display system message logs
Product-Group=junos		On SRX400 Series platforms, system message logs are not displayed in J-Web under Monitor > Log > System for any selected time range. The log entries remain available through the Junos OS Evolved command-line interface (CLI). This issue has no traffic impact and no other functional impact.

Resolved In: junos:26.4R1
PR NumberSynopsisCategory: Platform infra to support jvision
1940874
Minor		The /interfaces/interface/state/enabled/ does not export all interfaces under a single wrap
Product-Group=junos		On MX platforms with MPC1-11, LC2301/LC9600, LC4800 and MX304, when subscribed to the OpenConfig gNMI sensor /interfaces/interface/state/enabled/ with a 60-second sample interval, an incomplete data delivery at collector is observed when the device is deployed with 2 or more line cards.

Resolved In: evo:25.4R2-EVO evo:26.3R1-EVO junos:23.2R2-S8 junos:23.4R2-S3-J32 junos:24.2R2-S6 junos:24.4R2-S2-J17 junos:25.4R2 junos:25.4R2-S1 junos:25.4R2-S2 junos:26.3R1
PR NumberSynopsisCategory: Key Management Daemon
1909025
Critical		Junos OS: SRX Series, MX Series: When a specifically malformed first ISAKMP packet is received, kmd/iked crashes (CVE-2026-33778)
Product-Group=junos		An Improper Validation of Syntactic Correctness of Input vulnerability in the IPsec library used by kmd and iked of Juniper Networks Junos OS on SRX Series and MX Series allows an unauthenticated, network-based attacker to cause a complete Denial-of-Service (DoS). Please refer to https://supportportal.juniper.net/JSA107868 [juniper.net] for more information.

Resolved In: evo:23.4R2-S7-EVO evo:25.2R2-EVO evo:25.4R1-EVO evo:25.4R2-EVO evo:26.1R1-EVO junos:19.1R3-S15 junos:19.2R3-S12 junos:19.3R3-S13 junos:20.2R3-S12 junos:20.2X42 junos:20.3X75-D52 junos:21.2R3-S11 junos:21.2X33 junos:21.4R3-S13 junos:22.2R3-S8 junos:22.3R3-S5 junos:22.3X60 junos:22.4R3-S9 junos:23.2R2-S6 junos:23.4R2-S7 junos:24.2R2-S4 junos:24.4R2-J11 junos:24.4R2-S3 junos:25.2R1-S2 junos:25.2R2 junos:25.4R1 junos:25.4R2 junos:26.1R1
PR NumberSynopsisCategory: Layer2 forwarding on EX/NFX/PTX/QFX
1957710
Critical		Junos OS and Junos OS Evolved: Insufficient validation of VXLAN overlay ping causes information disclosure when EVPN-VXLAN is configured (CVE-2026-102054)
Product-Group=junos		An Improper Handling of Length Parameter Inconsistency vulnerability in L2ALM of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to obtain stale PFE packet memory via VXLAN overlay-ping traffic sent to a local VTEP. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.

Resolved In: evo:22.3X50-EVO evo:22.3X50-J5-EVO evo:22.3X80-D49-EVO evo:23.2R2-S7-EVO evo:23.2R2-S8-EVO evo:23.4R2-S8-EVO evo:24.2R2-S5-EVO evo:24.2R2-S6-EVO evo:24.4R2-S5-EVO evo:25.2R2-S2-EVO evo:25.2X100-D35-EVO evo:25.4R1-S3-EVO evo:25.4R2-EVO evo:25.4X300-EVO evo:26.2R1-S2-EVO evo:26.2R2-EVO evo:26.2X200-D10-EVO evo:26.2X200-EVO junos:20.3X75-D443 junos:20.3X75-D52-J3 junos:21.2R3-S11 junos:21.2X33 junos:21.2X34 junos:21.2X35 junos:21.4R3-S12 junos:21.4R3-S12-X1 junos:22.2R3-S8 junos:22.3X60-J4 junos:22.4R3-S10 junos:22.4R3-S9 junos:22.4X50 junos:24.2R2-S5 junos:24.2R2-S6 junos:24.4R2-S5 junos:25.2R2-S2 junos:25.4R2 junos:26.2R1-S2 junos:26.2R2 junos:26.3R1
PR NumberSynopsisCategory: Port-based link layer security services and protocols that a
1932925
Minor		MACsec traffic encryption/decryption failure post SFP OIR with interface and session in up state
Product-Group=junos		On MX301 platform, After SFP (Small Form-factor Pluggable transceiver) Online Insertion and Removal (OIR) on a MACsec (Media Access Control Security) enabled interface, the link and MACsec session remain UP, but MACsec encryption and decryption stop functioning. This results in traffic loss and causes service impact.

Resolved In: evo:25.4R2-EVO evo:26.2R2-EVO evo:26.3R1-EVO junos:25.4R2 junos:26.2R2 junos:26.3R1
PR NumberSynopsisCategory: SW PRs for MPC10E Interfaces
1881511
Minor		MX platforms with MPC10 and PPPoE subscribers can experience egress traffic black holing after WAN link flap events
Product-Group=junos		On MX Series routers equipped with MPC10 cards and high scale PPPoE (Point to Point Protocol over Ethernet) subscriber deployments, a WAN (Wide Area Networks) interface link flap under active traffic conditions can cause corruption of internal scheduler credits. When this occurs, Packet Forwarding Engine queue flush operations can fail and subscriber egress traffic can become permanently black holed. Symptoms include "cannot Free L1/L2/L3/L4 node" messages, and queue flush failures. The issue is more likely to occur on interfaces carrying significant subscriber traffic and repeated link flap events.

Resolved In: evo:26.4R1-EVO junos:23.4R2-S1-J12 junos:23.4R2-S3-J35 junos:23.4R2-S7-J27 junos:24.4R2-J22 junos:26.4R1
1945343
Major		Disabling one port in the breakout port channel makes another port down
Product-Group=junos		On all Junos MX platform, when MPC10E interfaces use breakout cabling, administratively disabling one breakout port may unexpectedly impact another port within the same MAC quad due to nondeterministic breakout initialization.

Resolved In: evo:25.4R2-EVO evo:26.2R1-EVO evo:26.3R1-EVO junos:22.4R3-S10 junos:23.2R1-S1-J11 junos:23.2R2-S8 junos:23.4R2-S7-J22 junos:23.4R2-S8-J3 junos:24.2R2-S5 junos:25.2R2-S1 junos:25.4R2 junos:26.2R1 junos:26.3R1
PR NumberSynopsisCategory: MPC11 ULC platform software related issues.
1809351
Major		JDI-RCT:M/Mx: ISIS session over MPC11 cards flapped due to "3-Way handshake failed" during ISSU (FRU upgrade stage - reboot phase)
Product-Group=junos		JDI-RCT:M/Mx: ISIS session over MPC11 cards flapped due to "3-Way handshake failed" during ISSU (FRU upgrade stage - reboot phase)

Resolved In:
PR NumberSynopsisCategory: Multiprotocol Label Switching
1908614
Major		Junos OS and Junos OS Evolved: If in a traffic engineering scenario a specific valid BGP-LS attribute is received rpd crashes (CVE-2026-102087)
Product-Group=junos		An Incomplete List of Disallowed Inputs vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS). Please refer to https://supportportal.juniper.net/JSA112168 [juniper.net] for more information.

Resolved In: evo:23.2R2-S6-EVO evo:23.4R2-S8-EVO evo:24.2R2-S4-EVO evo:24.4R2-S5-EVO evo:25.2R1-S2-EVO evo:25.2R2-EVO evo:25.4R1-EVO evo:26.1R1-EVO evo:26.3R1-EVO evo:26.4R1-EVO junos:22.4R3-S8 junos:22.4R3-S9 junos:23.2R2-S6 junos:23.4R2-S7 junos:24.2R2-S4 junos:24.4R2-S4 junos:25.2R1-S2 junos:25.2R2 junos:25.4R1 junos:26.1R1 junos:26.3R1 junos:26.4DCB
PR NumberSynopsisCategory: ACX Timing software
1900889
Major		High CPU utilization of the acx-arm-feb process on ACX710 platforms after upgrade or reboot when Precision Time Protocol (PTP) or Synchronous Ethernet (SyncE) is configured
Product-Group=junos		On ACX710 platforms running Junos OS, the acx-arm-feb process reaches 100 percent CPU utilization after a system upgrade or reboot when Precision Time Protocol (PTP) or Synchronous Ethernet (SyncE) is configured and the associated interfaces are enabled. This condition results in control plane degradation and traffic impact.

Resolved In: junos:23.2R2-S5 junos:23.4R2-S8 junos:23.4X12 junos:23.4X13 junos:23.4X14 junos:23.4X15 junos:23.4X18 junos:23.4X30 junos:24.2R2-S5 junos:24.4R2-S3 junos:24.4X3 junos:24.4X42 junos:25.2R2 junos:25.2R2-S2
PR NumberSynopsisCategory: build tools
1972129
Minor		FTP passive mode fails on Junos platforms
Product-Group=junos		On all Junos platforms, FTP ( File transfer protocol ) sessions using PASV mode fail. As a result, customers relying on PASV for fetching operational scripts experienced transfer failures. Impact included blocked transfers.

Resolved In: junos:24.2R2-S6 junos:25.4R2 junos:26.2R2 junos:26.4R1
PR NumberSynopsisCategory: vpls on branch (jseries and srx) platforms
1887306
Minor		ISIS adjacency not coming up on SRX 3XX series platforms in VPLS topology
Product-Group=junos		On SRX 3XX platforms, due to incorrect mbuf (Memory Buffer) allocation, the ISIS (Intermediate System-to-Intermediate System) packets with MPLS (Multiprotocol Label Switching) tag transiting over a L2VPN (Layer 2 Virtual Private Network) are dropped if the packet size exceeds 1500 bytes resulting in the ISIS adjacency remaining stuck in the initializing state, leading to routing issues. This issue is intermittent and observed only when the SRX 3XX device is serving as the PE in MPLS L2VPN network.

Resolved In: junos:25.4R1-S1 junos:25.4R2 junos:26.1R1 junos:26.2R1
PR NumberSynopsisCategory: QFX access control list
1936556
Major		Removal of the flexible-match-range from CLI, as it is not supported
Product-Group=junosvae		On Junos QFX5100, QFX5200, and QFX5210, the unsupported knob "flexible-match-range" under "ethernet-switching"is hidden from the CLI.

Resolved In: junos:25.2R2-S1 junos:25.4R2 junos:26.2R1
1950514
Major		GBP tag is not getting applied from prefix list when IPV4 or IPV6 address crosses certain limit
Product-Group=junos		On EX4100, EX4400, EX4650 & QFX5120 platforms having GBP configured in an EVPN-VXLAN setup it is observed that when IPV4 or IPV6 addresses in prefix-list crosses certain limit (for IPv4 is 8 or 9 depending on character width and for IPV6 limit is towards character length of buffer being 192 character width, with approx count 3 or 4) inconsistency is seen in the tagging behavior where some of the IP tags is not reflected. As a result this affects the policy and it does not work as per expectation. There is no traffic impact due to this issue.

Resolved In: evo:25.4R2-EVO evo:26.2R2-EVO evo:26.3R1-EVO junos:24.2R2-S6 junos:25.4R2 junos:26.2R1 junos:26.3R1
PR NumberSynopsisCategory: QFX L3 data-plane/forwarding
1944799
Major		ARP is not resolved on directly connected interface of Junos QFX5K platform enabled with Spanning Tree protocol
Product-Group=junos		On the Junos QFX5K platform, when any Spanning Tree Protocol (STP) variant, such as STP, RSTP, MSTP, or VSTP, is enabled, ARP is not resolved on QFX5K interfaces if the interface is configured with flexible VLAN tagging and Enterprise (EP) or Service Provider (SP) style configuration. As a result, IP traffic is lost over the affected interfaces.

Resolved In: junos:23.2R2-S8 junos:24.2R2-S6 junos:25.4R2 junos:26.3R1
PR NumberSynopsisCategory: QFX EVPN / VxLAN
1940800
Major		QFX5110 incorrectly converts untagged native VLAN traffic to tagged traffic on VXLAN egress
Product-Group=junos		On QFX5110 platforms running Junos OS, when Virtual Extensible LAN (VXLAN), flexible-vlan-tagging, vlan-id-list, native-vlan-id, and encapsulate-inner-vlan are configured together using a Service Provider (SP)-style configuration, untagged ingress traffic is VXLAN-encapsulated with an unexpected Virtual Local Area Network (VLAN) tag. As a result, the remote VXLAN Tunnel Endpoint (VTEP) receives the traffic as tagged instead of untagged, which can lead to end-to-end traffic loss.

Resolved In: junos:23.2R2-S8 junos:25.4R2 junos:26.2R2 junos:26.4R1
1952118
Major		In the EVPN VXLAN scenario restart routing causes multicast traffic disruption
Product-Group=junos		On Junos OS EX and QFX platforms, a routing process restart in an Ethernet VPN (EVPN) Virtual Extensible LAN (VXLAN) environment results in multicast traffic disruption due to the loss of multicast forwarding state on the Designated Forwarder (DF) switch.

Resolved In: junos:23.2R2-S8 junos:24.2R2-S6 junos:25.2R2-S2 junos:25.4R2 junos:26.2R2 junos:26.3R1
PR NumberSynopsisCategory: QFX5K JUNOS Interface, MACSec, Optics, SDK, PHY
1934076
Minor		The dcpfe process crash observed during a system reboot or PFE restart when software-based linkscan is configured
Product-Group=junos		On QFX5120-48Y, QFX5120-48T, QFX5120-32C and EX4650 platforms, a system reboot or PFE restart after configuring software-based linkscan causes the dcpfe process to crash. As a result, traffic forwarding on interfaces associated with the affected FPC will be temporarily impacted during the recovery period.

Resolved In: junos:25.2R2-S2 junos:25.4R2 junos:26.2R2 junos:26.3R1 junos:26.4R1
PR NumberSynopsisCategory: RPD infrastructure issues related to NSR, GRES, switchover,
1951132
Major		rpd crash caused by stale deleted tunnel entry
Product-Group=junos		On all Junos and Junos Evolved platforms, deleting a tunnel leaves its entry on the systems processing list instead of removing it. When the system later references this stale entry, it results in a crash. This issue is specific to APP-based dynamic tunnels.

Resolved In: evo:24.2R2-S6-EVO evo:25.4R2-EVO evo:26.2R2-EVO evo:26.3R1-EVO junos:21.2R3-S8-J18 junos:23.2R2-S8 junos:24.2R2-S6 junos:25.2R2-S2 junos:25.4R2 junos:26.2R1 junos:26.2R2 junos:26.3R1
PR NumberSynopsisCategory: RPD Next-hop issues including indirect, CNH, and MCNH
1922237
Major		In Class-Based Forwarding with ECMP scenario traffic gets dropped due to incorrect next-hop handling process in PFE programming
Product-Group=junos		On all Junos and Junos Evolved platforms where CBF (Class-Based Forwarding) and ECMP (Equal-Cost Multi Path) is configured and in non - MPLS (Multi-Protocol Label Switching) based IP traffic forwarding scenario, packet loss can be observed due to next-hop process handling in PFE (Packet Forwarding Engine) programming for indexed next-hop installation by CBF.

Resolved In: evo:26.2R1-EVO evo:26.2R2-EVO evo:26.3R1-EVO evo:26.4R1-EVO junos:26.2R2 junos:26.4R1
PR NumberSynopsisCategory: RPD route tables, resolver, routing instances, static routes
1957725
Major		The rpd process crash during RIB reconfiguration causing routing session resets and reconvergence
Product-Group=junos		On Junos OS and Junos OS Evolved platforms, the rpd (Routing Protocol Daemon) process crashes during RIB (Routing Information Base)-export configuration reconfiguration involving BGP (Border Gateway Protocol) routing policies, causing routing session flaps and routing reconvergence.

Resolved In: evo:25.4R2-EVO evo:26.2R2-EVO evo:26.3R1-EVO junos:25.2R2-J2 junos:25.2R2-S1-J13 junos:25.2R2-S2-J2 junos:25.2R2-S2-J7 junos:25.4R1-S2-J11 junos:25.4R2 junos:26.2R2 junos:26.3R1
PR NumberSynopsisCategory: Resource Reservation Protocol
1913565
Major		The rpd process crashes during repeated RSVP session clear operations
Product-Group=junos		On Junos and Junos OS Evolved platforms, the rpd process crashes when Resource Reservation Protocol (RSVP) sessions are repeatedly cleared under specific timing conditions. This issue occurs due to a timing window during RSVP processing on the standby Routing Engine (RE) while sessions are being re-established, which results in an invalid memory access and leads to an the rpd process crashes.

Resolved In: evo:25.4R2-EVO evo:26.1R1-EVO evo:26.2R1-EVO junos:24.4R2-S4 junos:25.4R2 junos:26.1R1 junos:26.2R1
1967461
Major		RSVP detour LSP does not follow configured FRR admin-group exclusion constraints
Product-Group=junos		On Junos OS and Junos OS Evolved platforms, when MPLS (Multiprotocol Label Switching), RSVP (Resource Reservation Protocol), dynamic tunnels, and an LSP (Label-Switched Path) template with FRR (Fast Reroute) admin-group exclusion constraints are configured, the detour LSP does not follow the configured exclusions after the primary LSP becomes unavailable. The detour LSP uses an unintended path, while traffic and services remain unaffected.

Resolved In: evo:25.4R2-EVO evo:26.2R2-EVO evo:26.3R1-EVO evo:26.4R1-EVO junos:25.4R2 junos:26.2R2 junos:26.3R1 junos:26.4R1
PR NumberSynopsisCategory: Issues related to control plane security
1865633
Major		Junos OS: A low-privileged user can escalate their privileges so that they can log in as root (CVE-2026-21916)
Product-Group=junos		A UNIX Symbolic Link (Symlink) Following vulnerability in the CLI of Juniper Networks Junos OS allows a local, authenticated attacker with low privileges to escalate their privileges to root, which will lead to a complete compromise of the system. Please refer to https://supportportal.juniper.net/JSA107807 [juniper.net] for more information.

Resolved In: evo:25.2R2-EVO junos:20.2R3-S12 junos:20.2X42 junos:20.3X75-D443 junos:21.2R3-S11 junos:21.2X33 junos:21.4R3-S10-J4 junos:21.4R3-S10-J4-X1 junos:21.4R3-S10-J6 junos:21.4R3-S12 junos:21.4R3-S13 junos:21.4X15 junos:22.4R3-S10 junos:22.4R3-S7-J1 junos:22.4R3-S9 junos:23.2R2-S6 junos:23.4R2-S6 junos:23.4R2-S7 junos:23.4X12 junos:23.4X13 junos:23.4X15 junos:23.4X30 junos:23.4X30-D30 junos:24.2R2-S3 junos:24.2R2-S4 junos:24.2X1 junos:24.2X4 junos:24.2X50 junos:24.4R2-S1 junos:24.4R2-S1-C1 junos:24.4R2-S2 junos:25.2R1-S1 junos:25.2R1-S2 junos:25.2R2
PR NumberSynopsisCategory: Issues related to broadband edge apps (PPP, DHCP) on Trio ch
1929254
Major		FPC crash triggered by peer member restart in AE bundle
Product-Group=junos		On Junos MX platforms with line card scale, and subscriber over AE (Aggregated Ethernet) is enabled, if one FPC hosting an AE member link restarts, another FPC hosting a different member link of the same AE bundle will crash. When the crash occur, PFEMAN is stuck for more than 240 seconds and traffic loss will occur on the affected FPCs.

Resolved In: junos:23.2R2-S8 junos:24.2R2-S6 junos:25.2R2-S1-J6 junos:25.2R2-S2 junos:25.4R2 junos:26.2R1 junos:26.3R1
PR NumberSynopsisCategory: Trio pfe qos software
1958296
Major		FPC major alarm triggered by AE member link flaps resulting in PFE being disabled
Product-Group=junos		On MX platforms with MPC7E/MPC8E/MPC9E/MPC10E/MPC11E/LC9600 line cards or an MX304 platform, The PFE (Packet Forwarding Engine) is disabled following a Major alarm on the FPC (Flexible PIC Concentrator), when the error message "XQSS_CMERROR_DSTAT_INT_REG_DROP0_VOTE_OVRN" is triggered after a member link of an AE (Aggregated Ethernet) interface flaps, resulting in traffic impact on the affected PFE.

Resolved In: evo:25.4R2-EVO evo:26.2R2-EVO evo:26.3R1-EVO junos:21.2X34 junos:23.2R2-S8 junos:24.2R2-S6 junos:24.4R2-S4-J27 junos:24.4R2-S4-J6 junos:25.2R2-J3 junos:25.2R2-S2 junos:25.4R1-S2-J10 junos:25.4R2 junos:26.2R1 junos:26.2R2 junos:26.3R1
PR NumberSynopsisCategory: Trio pfe bridging, learning, stp, oam, irb software
1950853
Major		Multicast traffic disruption on VLAN after CoS configuration changes
Product-Group=junos		On MX platforms , multicast traffic over VLAN interfaces (IRB) will be impacted after certain CoS (Class Of Service) configuration changes. This can result in multicast traffic not reaching downstream receivers.

Resolved In: evo:25.4R2-EVO evo:26.2R1-EVO evo:26.3R1-EVO junos:22.2R3-S8 junos:22.3R3-S5 junos:22.4R3-S10 junos:23.2R2-S8 junos:23.4R2-S7-J17 junos:24.2R2-S6 junos:25.2R2-S2 junos:25.4R2 junos:25.4R2-S1 junos:26.2R1 junos:26.3R1
PR NumberSynopsisCategory: Authentication, Authorization, Accounting, PAM (RADIUS/tacplus)
1957187
Major		MAC RADIUS CoA requests fail when the RADIUS server uses a management routing instance on Junos platforms
Product-Group=junos		On all Junos platforms, when Remote Authentication Dial-In User Service (RADIUS) is configured for IEEE 802.1X Media Access Control (MAC) RADIUS authentication and Change of Authorization (CoA) is used, if the RADIUS server is configured to use a management routing instance, CoA requests are not acknowledged and dynamic session updates such as IP address assignment and session timeout changes fail.

Resolved In: junos:21.4R3-S13 junos:23.2R2-S8 junos:23.4R2-S8 junos:24.2R2-S6 junos:24.4X6 junos:25.2R2-S2 junos:25.4R2 junos:26.2R1 junos:26.2R2 junos:26.3R1
PR NumberSynopsisCategory: Issues related to YANG Data Models
1781023
Minor		Few yang package are occuring multiple place On Box
Product-Group=junos		Few yang package are occuring multiple place On Box

Resolved In:
PR NumberSynopsisCategory: web filterig issues
1953486
Major		Traffic drops observed when using url-category without web filtering profile on Junos SRX Platforms
Product-Group=junos		On Junos SRX platforms, when only url-category is configured in policy (without web-filter policy), the packet handler continues to receive packets while the session is in HELD state, causing subsequent packets to be dropped.

Resolved In: junos:25.4R2 junos:26.2R1 junos:26.2R2 junos:26.3R1
PR NumberSynopsisCategory: Junos Fusion Aggregation Device Infra
1913169
Major		The smdp process crash is observed on MX Aggregation Device during Junos upgrade in a Junos Fusion Deployment
Product-Group=junos		In all Junos MX platforms acting as the AD (Aggregation Device) in a Junos Fusion deployment, a Junos software upgrade causes the smdp (Satellite Platform and Management Daemon) process to crash impacting forwarding plane services. This issue is observed when AD nodes are moved to a higher Junos version while the SD (Satellite nodes) are still running a lower version.

Resolved In: evo:25.4R2-EVO junos:22.4R3-S7-J7 junos:22.4R3-S9 junos:23.2R2-S6 junos:24.2R2-S6 junos:25.4R2
PR NumberSynopsisCategory: VSRX platform software
1953712
Major		vSRX3.0 connectivity loss and service disruption due to traffic interruption during processing delays
Product-Group=junos		On Junos OS vSRX3.0 platforms, two issues have been addressed. The first issue is related to flow control configured; connectivity loss and service disruption will be observed when the device experiences processing delays that can interrupt incoming network traffic. The issue affects critical control protocols such as BFD and BGP. The second issue is a CPU (Central Processing Unit) utilization display issue, where the show chassis routing-engine command reports CPU utilization for CPU0 only instead of showing the average utilization across all Routing Engine CPUs; this is a display-only issue.

Resolved In: evo:25.4R2-EVO junos:24.2R2-S6 junos:24.4R2-S3-J21 junos:25.2R2-S2 junos:25.4R2 junos:26.2R2 junos:26.3R1