The vulnerability is an Integer Overflow or Wraparound in the routing daemon (rpd) that allows an authenticated BGP peer to cause a denial of service through route updates when the extended‐nexthop‐tunnel option is enabled. An attacker can trigger a crash, resulting in loss of routing functionality and potential network outages.

Juniper Networks Junos OS and Junos OS Evolved are affected. The vendors provide patched releases: for Junos OS, 23.2R2‑S7.7, 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1 and all subsequent releases; for Junos OS Evolved, 23.2R2‑S7.7‑EVO, 23.4R2‑S8.11‑EVO, 24.2R2‑S5.6‑EVO, 24.4R2‑S5‑EVO, 25.2R2‑S2‑EVO, 25.2X100‑D35‑EVO, 25.4R1‑S3‑EVO, 25.4R2‑EVO, 25.4X300‑D40‑EVO, 26.2R1‑S2‑EVO, 26.2R2‑EVO, 26.4R1‑EVO and all subsequent releases.

The CVSS score of 8.7 classifies this as a high‑severity denial‑of‑service flaw. EPSS is not available, so the current exploitation probability is unclear, and the vulnerability has not yet been listed in the CISA KEV catalog. Exploitation requires an authenticated BGP peer to send route updates that trigger the integer overflow, implying that insiders or compromised peers can cause the crash. The impact is a crash of the routing daemon, potentially taking the device offline or impairing routing until a restart or patch is applied.