A NULL pointer dereference in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated remote BGP neighbor to cause the daemon to crash. The vulnerability is triggered by a specific VPN‑flowspec BGP update that is readvertised while BMP post‑policy RIB‑out monitoring is enabled, leading to a denial of service on the affected device.

Juniper Networks Junos OS and Junos OS Evolved are affected. Vulnerable releases include Junos OS 23.2R2‑S7.7, 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1, and all future releases. For Junos OS Evolved, affected releases are 23.2R2‑S7.7‑EVO, 23.4R2‑S8.11‑EVO, 24.2R2‑S5.6‑EVO, 24.4R2‑S5‑EVO, 25.2R2‑S2‑EVO, 25.2X100‑D35‑EVO, 25.4R1‑S3‑EVO, 25.4R2‑EVO, 25.4X300‑D40‑EVO, 26.2R1‑S2‑EVO, 26.2R2‑EVO, 26.4R1‑EVO, and all later releases. Earlier respins of the 23.2, 23.4, and 24.2 releases and their Evolved variants have been rebuilt to fix this issue.

The CVSS score of 8.7 indicates high severity. The EPSS score is less than 1%, indicating a very low but non‑zero exploitation probability. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely observed in the wild. Attackers can trigger the crash by establishing an unauthenticated BGP session and injecting a VPN‑flowspec update while the device’s BMP monitoring is active, thereby causing an unauthenticated remote denial of service.