An improper handling of the length parameter within the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved causes a heap data disclosure when traffic‑engineering routing is enabled. This flaw, identified as CWE‑130, allows a malicious BGP‑LS peer to send malformed UPDATE messages over a session, causing the daemon to read beyond intended bounds and expose sensitive internal data structures. The resulting disclosure compromises the confidentiality of the device’s internal state and may allow an attacker to gain insight into routing policies and internal memory contents.

The vulnerability affects Juniper Networks Junos OS and Junos OS Evolved. Specifically, all releases mentioned in the CNA solution (23.2R2‑S7.7, 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1, and all subsequent releases for Junos OS; 23.2R2‑S7.7‑EVO, 23.4R2‑S8.11‑EVO, 24.2R2‑S5.6‑EVO, 24.4R2‑S5‑EVO, 25.2R2‑S2‑EVO, 25.2X100‑D35‑EVO, 25.4R1‑S3‑EVO, 25.4R2‑EVO, 25.4X300‑D40‑EVO, 26.2R1‑S2‑EVO, 26.2R2‑EVO, 26.4R1‑EVO, and all subsequent releases for Junos OS Evolved).

The CVSS base score of 5.3 indicates a medium severity vulnerability. The EPSS score of 0.00189 (<1%) shows a very low exploitation probability at this time, and it is not listed in KEV. The flaw is exploitable through network traffic, requiring an attacker to inject malformed UPDATE messages on a BGP‑LS session with traffic‑engineering enabled. The lack of a known workaround means that the only reliable protection is to update to a patched release. Defenses should also consider disabling the traffic‑engineering address family if it is not critical for operations.