A NULL pointer dereference in Juniper's routing protocol daemon (rpd) allows an unauthenticated remote BGP peer to send a crafted FlowSpec update that causes the rpd process to crash. The crash leads to a router reboot or loss of BGP routing information, resulting in a denial of service on the affected device.

All Juniper Networks Junos OS and Junos OS Evolved routers running any release prior to the updates listed by the vendor, including the 23.2R2‑S7.7, 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1 series and corresponding Evo releases such as 23.2R2‑S7.7‑EVO, 23.4R2‑S8.11‑EVO, 24.2R2‑S5.6‑EVO, 24.4R2‑S5‑EVO, 25.2R2‑S2‑EVO, 25.4R1‑S3‑EVO, 25.4R2‑EVO, 26.2R1‑S2‑EVO, 26.2R2‑EVO, 26.4R1‑EVO and all later releases excluded from the advisory.

The vulnerability has a CVSS base score of 8.7, indicating high severity. The EPSS score is less than 1%, reflecting a low probability of current exploitation, and the issue is not listed in the CISA KEV catalog, meaning no confirmed exploit is known. An attacker who can establish an unauthenticated BGP session with the target device could trigger the flaw by sending a specialized BGP FlowSpec update, causing an rpd crash and disrupting routing services.