A reachable assertion in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP‑LS peer to send crafted BGP‑LS Link NLRI advertisements that cause the rpd to crash. The crash results in a denial of service to the routing process, potentially disrupting BGP communication and overall network routing availability

The affected systems are Juniper Networks Junos OS and Junos OS Evolved, specifically the releases listed in the vendor’s solution: Junos OS 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1 and later; Junos OS Evolved 24.4R2‑S5‑EVO, 25.2R2‑S2‑EVO, 25.2X100‑D35‑EVO, 25.4R1‑S3‑EVO, 25.4R2‑EVO, 25.4X300‑D40‑EVO, 26.2R1‑S2‑EVO, 26.2R2‑EVO, 26.4R1‑EVO and later

With a CVSS score of 8.7, this vulnerability is considered high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed widespread exploitation as of the current data. The likely attack vector is an attacker who can reach a configured BGP‑LS peer; by sending a malicious advertisement, the attacker can trigger the crash. The impact is a loss of routing service and potential network outages, making it a significant risk for systems that rely on continuous BGP availability