A reachable assertion flaw in the Juniper routing protocol daemon (rpd) allows an adjacent eBGP peer, when automatic site‑ID negotiation is enabled on a VPLS connection, to send a crafted signaling update that causes rpd to crash. The crash results in a denial of service that can disconnect the device from the routing fabric and interrupt network traffic until the daemon is restarted. As rpd is core to the routing layer, the outage can affect all routes propagated by the device, potentially impacting multiple downstream users or services.

Juniper Networks Junos OS and Junos OS Evolved are affected. For Junos OS the fix applies to releases 23.2R2‑S7.7, 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1 and all later releases. For Junos OS Evolved the fix applies to releases 23.2R2‑S7.7‑EVO, 23.4R2‑S8.11‑EVO, 24.2R2‑S5.6‑EVO, 24.4R2‑S5‑EVO, 25.2R2‑S2‑EVO, 25.2X100‑D35‑EVO, 25.4R1‑S3‑EVO, 25.4R2‑EVO, 25.4X300‑D40‑EVO, 26.2R1‑S2‑EVO, 26.2R2‑EVO, 26.4R1‑EVO and all subsequent releases.

The CVSS score of 7.1 indicates a high likelihood of impact. The EPSS score of 0.00269 indicates a very low but non‑zero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to be an adjacent eBGP peer and the device must have automatic site‑ID negotiation turned on. An attacker could simply issue a malicious VPLS signaling update to crash rpd, resulting in a denial of service without any authentication or privileged access. No workaround is available, so the only mitigations are to apply the vendor’s patch or upgrade to a later release.