Description
A Missing Release of Memory after Effective Lifetime vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a local, low privileged user to cause an impact to the availability of the device.

When RIB sharding is enabled and a user executes one of several routing related 'show' commands, a certain amount of memory is leaked. When all available memory has been consumed rpd will crash and restart.

The leak can be monitored with the CLI command:



show task memory detail | match task_shard_mgmt_cookie



where the allocated memory in bytes can be seen to continuously increase with each exploitation.



This issue affects:

Junos OS:

* all versions before 21.2R3-S9,
* 21.4 versions before 21.4R3-S11,
* 22.2 versions before 22.2R3-S7,
* 22.4 versions before 22.4R3-S7,
* 23.2 versions before 23.2R2-S4, 
* 23.4 versions before 23.4R2-S4,
* 24.2 versions before 24.2R2,
* 24.4 versions before 24.4R1-S2, 24.4R2;


Junos OS Evolved:

* all versions before 22.2R3-S7-EVO
* 22.4-EVO versions before 22.4R3-S7-EVO,
* 23.2-EVO versions before 23.2R2-S4-EVO,
* 23.4-EVO versions before 23.4R2-S4-EVO,
* 24.2-EVO versions before 24.2R2-EVO, 
* 24.4-EVO versions before 24.4R2-EVO.
Published: 2025-07-11
Score: 6.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

Vendor Solution

The following software releases have been updated to resolve this specific issue: Junos OS Evolved: 22.2R3-S7-EVO, 22.4R3-S7-EVO, 23.2R2-S4-EVO, 23.4R2-S4-EVO, 24.2R2-EVO, 24.4R2-EVO, 25.2R1-EVO, and all subsequent releases; Junos OS: 21.2R3-S9, 21.4R3-S11, 22.2R3-S7, 22.4R3-S7, 23.2R2-S4, 23.4R2-S4, 24.2R2, 24.4R1-S2, 24.4R2, 25.2R1, and all subsequent releases.


Vendor Workaround

Use access lists or firewall filters to limit access to the CLI only from trusted hosts and administrators.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-21144 A Missing Release of Memory after Effective Lifetime vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a local, low privileged user to cause an impact to the availability of the device. When RIB sharding is enabled and a user executes one of several routing related 'show' commands, a certain amount of memory is leaked. When all available memory has been consumed rpd will crash and restart. The leak can be monitored with the CLI command: show task memory detail | match task_shard_mgmt_cookie where the allocated memory in bytes can be seen to continuously increase with each exploitation. This issue affects: Junos OS: * all versions before 21.2R3-S9, * 21.4 versions before 21.4R3-S11, * 22.2 versions before 22.2R3-S7, * 22.4 versions before 22.4R3-S7, * 23.2 versions before 23.2R2-S4,  * 23.4 versions before 23.4R2-S4, * 24.2 versions before 24.2R2, * 24.4 versions before 24.4R1-S2, 24.4R2; Junos OS Evolved: * all versions before 22.2R3-S7-EVO * 22.4-EVO versions before 22.4R3-S7-EVO, * 23.2-EVO versions before 23.2R2-S4-EVO, * 23.4-EVO versions before 23.4R2-S4-EVO, * 24.2-EVO versions before 24.2R2-EVO,  * 24.4-EVO versions before 24.4R2-EVO.
History

Fri, 30 Jan 2026 20:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:o:juniper:junos:21.4:r3-s11:*:*:*:*:*:*

Fri, 23 Jan 2026 17:15:00 +0000

Type Values Removed Values Added
First Time appeared Juniper
Juniper junos
Juniper junos Os Evolved
CPEs cpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:21.2:-:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:21.2:r1-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:21.2:r1-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:21.2:r1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:21.2:r2-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:21.2:r2-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:21.2:r2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:21.2:r3-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:21.2:r3-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:21.2:r3-s3:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:21.2:r3-s4:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:21.2:r3-s5:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:21.2:r3-s6:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:21.2:r3-s7:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:21.2:r3-s8:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:21.2:r3:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:21.4:-:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:21.4:r1-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:21.4:r1-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:21.4:r1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:21.4:r2-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:21.4:r2-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:21.4:r2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:21.4:r3-s10:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:21.4:r3-s11:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:21.4:r3-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:21.4:r3-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:21.4:r3-s3:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:21.4:r3-s4:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:21.4:r3-s5:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:21.4:r3-s6:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:21.4:r3-s7:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:21.4:r3-s8:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:21.4:r3-s9:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:21.4:r3:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:22.2:-:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:22.2:r1-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:22.2:r1-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:22.2:r1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:22.2:r2-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:22.2:r2-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:22.2:r2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:22.2:r3-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:22.2:r3-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:22.2:r3-s3:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:22.2:r3-s4:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:22.2:r3-s5:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:22.2:r3-s6:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:22.2:r3:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:22.4:-:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:22.4:r1-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:22.4:r1-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:22.4:r1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:22.4:r2-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:22.4:r2-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:22.4:r2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:22.4:r3-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:22.4:r3-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:22.4:r3-s3:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:22.4:r3-s4:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:22.4:r3-s5:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:22.4:r3-s6:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:22.4:r3:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:23.2:-:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:23.2:r1-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:23.2:r1-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:23.2:r1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:23.2:r2-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:23.2:r2-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:23.2:r2-s3:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:23.2:r2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:23.4:-:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:23.4:r1-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:23.4:r1-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:23.4:r1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:23.4:r2-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:23.4:r2-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:23.4:r2-s3:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:23.4:r2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:24.2:-:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:24.2:r1-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:24.2:r1-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:24.2:r1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:24.4:-:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:24.4:r1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:24.4:r2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:*:*:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:22.2:-:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:22.2:r1-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:22.2:r1-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:22.2:r1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:22.2:r2-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:22.2:r2-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:22.2:r2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:22.2:r3-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:22.2:r3-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:22.2:r3-s3:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:22.2:r3-s4:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:22.2:r3-s5:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:22.2:r3-s6:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:22.2:r3:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:22.4:-:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:22.4:r1-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:22.4:r1-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:22.4:r1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:22.4:r2-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:22.4:r2-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:22.4:r2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:22.4:r3-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:22.4:r3-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:22.4:r3-s3:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:22.4:r3-s4:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:22.4:r3-s5:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:22.4:r3-s6:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:22.4:r3:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:23.2:-:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:23.2:r1-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:23.2:r1-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:23.2:r1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:23.2:r2-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:23.2:r2-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:23.2:r2-s3:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:23.2:r2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:23.4:-:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:23.4:r1-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:23.4:r1-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:23.4:r1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:23.4:r2-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:23.4:r2-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:23.4:r2-s3:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:23.4:r2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:24.2:-:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:24.2:r1-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:24.2:r1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:24.4:-:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:24.4:r1-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:24.4:r1-s3:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:24.4:r1:*:*:*:*:*:*
Vendors & Products Juniper
Juniper junos
Juniper junos Os Evolved

Tue, 15 Jul 2025 20:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Sat, 12 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00013}


Fri, 11 Jul 2025 15:30:00 +0000

Type Values Removed Values Added
Description A Missing Release of Memory after Effective Lifetime vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a local, low privileged user to cause an impact to the availability of the device. When RIB sharding is enabled and a user executes one of several routing related 'show' commands, a certain amount of memory is leaked. When all available memory has been consumed rpd will crash and restart. The leak can be monitored with the CLI command: show task memory detail | match task_shard_mgmt_cookie where the allocated memory in bytes can be seen to continuously increase with each exploitation. This issue affects: Junos OS: * all versions before 21.2R3-S9, * 21.4 versions before 21.4R3-S11, * 22.2 versions before 22.2R3-S7, * 22.4 versions before 22.4R3-S7, * 23.2 versions before 23.2R2-S4,  * 23.4 versions before 23.4R2-S4, * 24.2 versions before 24.2R2, * 24.4 versions before 24.4R1-S2, 24.4R2; Junos OS Evolved: * all versions before 22.2R3-S7-EVO * 22.4-EVO versions before 22.4R3-S7-EVO, * 23.2-EVO versions before 23.2R2-S4-EVO, * 23.4-EVO versions before 23.4R2-S4-EVO, * 24.2-EVO versions before 24.2R2-EVO,  * 24.4-EVO versions before 24.4R2-EVO.
Title Junos OS and Junos OS Evolved: When RIB sharding is configured each time a show command is executed RPD memory leaks
Weaknesses CWE-401
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 6.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/RE:M'}


Subscriptions

Juniper Junos Junos Os Evolved
Juniper Networks Junos Os Junos Os Evolved
cve-icon MITRE

Status: PUBLISHED

Assigner: juniper

Published:

Updated: 2025-07-15T19:55:10.352Z

Reserved: 2025-06-23T18:23:44.546Z

Link: CVE-2025-52986

cve-icon Vulnrichment

Updated: 2025-07-11T16:04:39.481Z

cve-icon NVD

Status : Analyzed

Published: 2025-07-11T16:15:26.020

Modified: 2026-01-30T20:42:45.180

Link: CVE-2025-52986

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2025-07-12T23:05:33Z

Weaknesses