An improper handling of length parameters in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved can be exploited by an unauthenticated network attacker to crash the routing process. The flaw allows a malformed EVPN Type‑3 or Type‑4 route received from a configured EVPN peer to be processed during re‑advertisement, leading to a rpd crash or service disruption. The impact is limited to service interruption of routing functions, potentially causing loss of routing information and network instability, without compromising confidentiality or integrity.

The vulnerability affects Junos OS and Junos OS Evolved firmware. Affected releases include Junos OS 23.2R2‑S7.7, 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1, and all subsequent releases. For Junos OS Evolved the affected releases are 23.2R2‑S7.7‑EVO, 23.4R2‑S8.11‑EVO, 24.2R2‑S5.6‑EVO, 24.4R2‑S5‑EVO, 25.2R2‑S2‑EVO, 25.2X100‑D35‑EVO, 25.4R1‑S3‑EVO, 25.4R2‑EVO, 25.4X300‑D40‑EVO, 26.2R1‑S2‑EVO, 26.2R2‑EVO, 26.4R1‑EVO, and all subsequent releases.

The vulnerability carries a high CVSS score of 8.7 and is exploitable over the network without authentication via an EVPN peer. Attackers can send crafted EVPN routes to a running switch, triggering a crash of the rpd process and resulting in a denial of service. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. Because the attack requires direct connectivity to an EVPN peer, services that rely on EVPN route signaling are at high risk, and the potential for widespread network disruption exists if the affected platform is in active use.