The vulnerability is a NULL pointer dereference in the routing‑policy nexthop‑ECMP matcher of Juniper Networks Junos OS and Junos OS Evolved. When an eBGP peer sends a specific BGP packet while a nexthop‑ECMP qualifier is attached to an import policy, the routing‑daemon (rpd) crashes. This is a denial of service that can disrupt network routing and availability, and it is classified as CWE‑476.

Affected products are Juniper Networks Junos OS and Junos OS Evolved. All releases prior to the patched versions are vulnerable. For Junos OS the vulnerable releases are 23.2R2‑S7.7, 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1 and any subsequent releases. For Junos OS Evolved the vulnerable releases are 23.2R2‑S7.7‑EVO, 23.4R2‑S8.11‑EVO, 24.2R2‑S5.6‑EVO, 24.4R2‑S5‑EVO, 25.2R2‑S2‑EVO, 25.2X100‑D35‑EVO, 25.4R1‑S3‑EVO, 25.4R2‑EVO, 25.4X300‑D40‑EVO, 26.2R1‑S2‑EVO, 26.2R2‑EVO, 26.4R1‑EVO and any subsequent releases. Specific respins are referenced for major releases 23.2, 23.4, and 24.2 for both OS variants.

The CVSS score of 8.7 indicates high severity, and the EPSS score is currently unavailable. The vulnerability is not listed in CISA’s KEV catalog, implying that no publicly known exploit exists yet. The likely attack vector requires a malicious or misconfigured eBGP peer that can send the crafted BGP packet to the affected device; control of a BGP peering is therefore a prerequisite. If successfully exploited, the routing‑daemon crash would lead to a denial of service that could affect the entire network topology relying on the affected device. No workaround has been published, so the only viable protection is an upgrade to a patched release.