A BGP peer can trigger a crash of the routing protocol daemon by sending an LLGR‑stale route update that is re‑advertised to a non‑LLGR‑capable neighbor. This improper initialization flaw results in an adverse effect where the system becomes unavailable. The weakness corresponds to CWE‑665, illustrating that a failure to initialize data structures correctly can lead to catastrophic failure.

The flaw affects Juniper Networks Junos OS and Junos OS Evolved. Vulnerable versions include all releases earlier than those listed in the advisory – specifically any Junos OS release before 23.2R2‑S7.7 (including earlier 23.2, 23.4, 24.2 releases) and any Junos OS Evolved release before 23.2R2‑S7.7‑EVO. Devices running a pre‑patch version of either operating system are within scope.

The CVSS V3 base score of 8.7 classifies this as a severe vulnerability. The EPSS score is < 1% and the issue is not listed in the CISA KEV catalog, but the lack of known exploitation data does not reduce the threat that an attacker with the ability to open a BGP session could cause a denial of service without authentication or privileged configuration changes. The most likely attack vector requires an active BGP session to an LLGR‑enabled neighbor; the attacker must send a stale route update that is later readvertised. Given the high CVSS score, the official recommendation is to patch or otherwise mitigate as quickly as possible.