A mismatched memory management error in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated network‑based attacker to send a crafted BGP route update that includes extended next‑hop tunneling and SRv6 service processing. The malformed update triggers a memory corruption that crashes the rpd process, resulting in a denial of service because the routing daemon is no longer available to process routing information.

The vulnerability affects Juniper Networks Junos OS and Junos OS Evolved devices that are running firmware prior to the security updates listed in the advisory—specifically, any releases older than Junos OS 23.2R2‑S7.7, 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1 and the corresponding Junos OS Evolved releases before 23.2R2‑S7.7‑EVO, 23.4R2‑S8.11‑EVO, 24.2R2‑S5.6‑EVO, 24.4R2‑S5‑EVO, 25.2R2‑S2‑EVO, 25.2X100‑D35‑EVO, 25.4R1‑S3‑EVO, 25.4R2‑EVO, 25.4X300‑D40‑EVO, 26.2R1‑S2‑EVO, 26.2R2‑EVO, 26.4R1‑EVO.

The CVSS score of 8.7 indicates a high severity impact. While the EPSS score is not available, the requirement for legitimate authentication limits the set of attackers to those that can authenticate to the device, yet the potential service disruption remains substantial. The vulnerability is not listed in the CISA KEV catalog, but the lack of an official workaround means the only viable mitigation is to patch the firmware to one of the releases that resolve the issue.