An improper validation of input quantity in Juniper’s routing daemon (rpd) causes a crash when an adjacent device sends a crafted IS‑IS SRv6 packet while SRv6 and the flexible algorithm is enabled. The flaw results in a denial of service that can be triggered by a local participant on the same network, disrupting routing operations.

Affected systems include Juniper Networks Junos OS and Junos OS Evolved firmware on network routers. The issue exists in all releases prior to Junos OS 23.2R2‑S7.7, 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1 and earlier Junos OS releases, and similarly in all Junos OS Evolved releases before 23.2R2‑S7.7‑EVO, 23.4R2‑S8.11‑EVO, 24.2S5.6‑EVO, 24.4R2‑S5‑EVO, 25.2R2‑S2‑EVO, 25.2X100‑D35‑EVO, 25.4R1‑S3‑EVO, 25.4R2‑EVO, 25.4X300‑D40‑EVO, 26.2R1‑S2‑EVO, 26.2R2‑EVO, 26.4R1‑EVO and earlier. All subsequent releases contain the fix. Devices adjacent to the router on the same IS‑IS domain with SRv6 and flexible algorithm enabled can trigger the exploit.

The CVSS score of 7.1 places this flaw in the high‑severity range. The EPSS score of < 1% indicates a very low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. An attacker must be adjacent and able to send a crafted IS‑IS SRv6 packet with SRv6 and flexible algorithm enabled. Once triggered, the routing daemon crashes, causing a denial of service of the router. Remediation involves upgrading to the patched releases listed by Juniper; no workaround is available.