A reachable assertion in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to crash the rpd service when LDP is enabled. The exploit is triggered by an established LDP session carrying an IPv6 Prefix FEC in a specific Label message, which results in a denial of service by terminating the routing process on the device.

Juniper Networks Junos OS and Junos OS Evolved are affected. The issue appears in Junos OS releases 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1 and all subsequent releases. For Junos OS Evolved the affected releases are 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO and all subsequent releases. Earlier respins of releases 23.2, 23.4, and 24.2, and their Evolved counterparts have also been rebuilt to address this vulnerability.

The CVSS score is 7.1, indicating a high severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, implying no known large‑scale attacks. The attack vector requires an adjacent attacker with network proximity to establish an LDP session and send the specially crafted Label message, so remote exploitation from the Internet is unlikely. Successful exploitation leads to a temporary denial of service on the affected Juniper device by crashing the routing process.