A reachable assertion in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a network‑adjacent BGP peer to trigger a crash when a labeled‑unicast aggregate‑label is configured. The crash results in a denial of service that can interrupt routing, potentially cascading to wider network outages. The weakness is classified as CWE‑617, indicating an improper validation of inputs or assumptions by the software.

The affected products are Juniper Networks Junos OS versions 23.2R2‑S7.7, 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1, and any newer releases; and Juniper Networks Junos OS Evolved versions 23.2R2‑S7.7‑EVO, 23.4R2‑S8.11‑EVO, 24.2R2‑S5.6‑EVO, 24.4R2‑S5‑EVO, 25.2R2‑S2‑EVO, 25.4R1‑S3‑EVO, 25.4R2‑EVO, 26.2R1‑S2‑EVO, 26.2R2‑EVO, 26.4R1‑EVO and any newer releases. For the 23.2, 23.4, and 24.2 releases of both OS and EVO, specific respins have been released and older builds have been rebuilt to address the vulnerability.

The vulnerability carries a CVSS score of 7.1, indicating a high impact. The EPSS score of less than 1% and absence from the CISA KEV catalog suggest that exploitation attempts are currently rare. Attackers must be a BGP neighbor capable of advertising a labeled‑unicast aggregate‑label; thus the attack vector is network‑adjacent. If exploited, the rpd crash can force a router restart or make the device unavailable, disrupting routing services that rely on that router. While the flaw does not enable arbitrary code execution, it constitutes a serious denial‑of‑service risk for networks that rely on the affected devices.