The vulnerability is a reachable assertion flaw in the rpd process of Juniper Networks Junos OS and Junos OS Evolved. The flaw allows an authenticated network‑based attacker to trigger a denial of service by sending certain BGP‑LS routing updates. The impact is the interruption or reset of the rpd process, which can affect critical routing functions and lead to loss of connectivity for networks depending on BGP‑LS updates. This issue stems from CWE‑617, where unvalidated input or state can lead to a failed assertion, causing the process to terminate.

Affected platforms are Juniper Networks Junos OS and Junos OS Evolved. The vulnerability applies to a wide range of releases: Junos OS 23.2R2‑S7.7, 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1 and all subsequent releases; and Junos OS Evolved 23.2R2‑S7.7‑EVO, 23.4R2‑S8.11‑EVO, 24.2R2‑S5.6‑EVO, 24.4R2‑S5‑EVO, 25.2R2‑S2‑EVO, 25.2X100‑D35‑EVO, 25.4R1‑S3‑EVO, 25.4R2‑EVO, 25.4X300‑D40‑EVO, 26.2R1‑S2‑EVO, 26.2R2‑EVO, 26.4R1‑EVO and all subsequent revisions.

The CVSS score of 8.7 indicates a high severity of exploitation. The EPSS score is not available and the vulnerability is not listed in CISA KEV, suggesting limited current public exploitation but a high potential for future attacks. The only prerequisite for exploitation is an authenticated session on the network. Therefore, attackers with valid credentials can trigger a denial of service by crafting specific BGP‑LS TRE exports, leading to a reset of the rpd process and possible network outage.