A reachable assertion flaw in the rpd (Routing Protocol Daemon) process of Juniper Networks Junos OS and Junos OS Evolved allows an attacker who is adjacent on the network to cause the rpd process to crash, resulting in a denial of service. The flaw is triggered when two misconfigured neighbors or a neighbor duplicated by a layer‑two loop advertise the same transport address on a link‑protected interface. Because the rpd process stops, router command‑line and remote management services become unavailable, severely impacting network availability. The vulnerability does not directly expose data or modify configuration, so confidentiality and integrity are not affected, but the availability impact is significant.

The flaw affects Juniper Networks Junos OS and Junos OS Evolved. Vulnerable releases include Junos OS versions 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1 and all subsequent releases; and Junos OS Evolved versions 23.2R2-S7.7‑EVO, 23.4R2-S8.11‑EVO, 24.2R2-S5.6‑EVO, 24.4R2-S5‑EVO, 25.2R2-S2‑EVO, 25.2X100-D35‑EVO, 25.4R1-S3‑EVO, 25.4R2‑EVO, 25.4X300-D40‑EVO, 26.2R1-S2‑EVO, 26.2R2‑EVO, 26.4R1‑EVO and all subsequent releases.

The CVSS score of 7.1 indicates a moderate to high severity vulnerability. No exploit probability score is currently available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread active exploitation has not been observed. However, the required conditions—adjacent attacker with access to a LDP‑protected interface, misconfigured neighbor advertisement, or a layer‑two loop—are achievable on many enterprise networks, making the risk realistic. Without an official workaround, an attacker could execute the flaw by configuring a duplicated transport address or forming a L2 loop to trigger the assertion, resulting in a denial of service for all services dependent on rpd.