A reachable assertion within the rpd process of Juniper’s Junos OS and Junos OS Evolved causes a crash when an adjacent OSPF peer sends LSAs that trigger Prefix‑SID best‑route installation while Source Packet Routing is active. The crash terminates the routing daemon, resulting in a loss of routing services and a denial of service for any hosts relying on the router. The flaw is identified as CWE‑617, a reachable assertion error.

The vulnerability affects Juniper Networks’ Junos OS and Junos OS Evolved on all releases prior to the patched versions listed. Vulnerable releases include 23.2, 23.4, 24.2, 25.2, 25.4, 26.2, and 26.4 for both products; respins are also available for 23.2, 23.4, and 24.2 and the equivalent Evolved line. Any release that has been updated to 23.2R2‑S7.7, 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1 or their subsequent releases is fixed.

The CVSS base score of 7.1 indicates a moderate to high impact. The EPSS score is less than 1%, suggesting a low but nonzero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker must be an adjacent OSPF peer that can inject crafted LSAs; the attack vector is local to the OSPF area, so compromised or adjacent devices can trigger the crash.