An Allocation of Resources Without Limits or Throttling flaw in Juniper Networks' routing protocol daemon (rpd) causes the daemon to crash and corrupt heap memory when it processes OSPFv3 packets on an enabled broadcast interface. The vulnerability does not require authentication and can be triggered by an adjacent attacker who can send crafted OSPFv3 messages. When exploited, the router experiences a denial of service as the routing protocol process crashes and may become unresponsive, potentially disrupting network connectivity across the affected device.

Affected products include Juniper Networks Junos OS and Junos OS Evolved platforms. The flaw applies to all releases prior to Junos OS 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1 and all subsequent releases, as well as the corresponding Junos OS Evolved releases 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO and all subsequent revisions. Specific respins have also been released for certain early releases.

The CVSS score of 7.1 signals a high severity. Although the EPSS score is currently unavailable, the absence of a KEV listing suggests no confirmed exploitation to date. Attackers need to be on the same broadcast segment as the router and able to send OSPFv3 traffic to exploit the bug. The unauthenticated nature of the flaw lowers the barrier to attack, but proximity and OSPFv3 configuration limit the attack surface to physically connected routers. Successful exploitation results in a denial of service that can interrupt critical routing functions.