An Allocation of Resources Without Limits or Throttling flaw in Juniper Networks' routing protocol daemon (rpd) causes the daemon to crash and corrupt heap memory when it processes OSPFv3 packets on an enabled broadcast interface. The vulnerability does not require authentication and can be triggered by an adjacent attacker who sends OSPFv3 messages. When exploited, the router experiences a denial of service as the routing protocol process crashes and may become unresponsive, potentially disrupting network connectivity across the affected device.

Affected products are Juniper Networks Junos OS and Junos OS Evolved. The vulnerability exists in releases older than the specific versions listed in the vendor's fix list. The vendor has fixed the issue in Junos OS releases 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1 and the corresponding Junos OS Evolved releases: 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO. All earlier releases, including certain early branch vulnerable unless the device is upgraded to one of these or later revisions.

The CVSS score of 7.1 signals a high severity. The EPSS score of < 1% indicates a low but non‑zero likelihood of exploitation, although the absence of a KEV listing suggests no confirmed exploitation to date. Attackers need to be on the same broadcast segment as the router and able to send OSPFv3 traffic to exploit the bug. The unauthenticated nature of the flaw lowers the barrier to attack, but proximity and OSPFv3 configuration limit the attack surface to physically connected routers. Successful exploitation results in a denial of service that can interrupt critical routing functions.