A buffer size miscalculation in Juniper’s routing protocol daemon (rpd) causes a crash when a configured eBGP neighbor sends labeled‑unicast UPDATE messages while multipath next‑hops are enabled. The resulting router crash produces an out‑of‑band denial of service that takes the device offline, eliminating routing functionality and disrupting network availability. No evidence indicates that the vulnerability directly compromises confidentiality or integrity, but the loss of routing capability can affect critical network services.

The flaw affects Juniper Networks Junos OS and Junos OS Evolved routers. Affected releases include Junos OS 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1 and all later builds; Junos OS Evolved 24.4R2‑S5‑EVO, 25.2R2‑S2‑EVO, 25.2X100‑D35‑EVO, 25.4R1‑S3‑EVO, 25.4R2‑EVO, 25.4X300‑D40‑EVO, 26.2R1‑S2‑EVO, 26.2R2‑EVO, 26.4R1‑EVO and all subsequent releases.

The CVSS score of 8.7 classifies the vulnerability as high severity. The EPSS score is reported as less than 1 %, indicating a very low but non‑zero probability that an attack will be carried out. The issue is not listed in the CISA KEV catalog, so no active exploitation campaigns are known. The most likely attack vector is a remote network adversary that can contact the router as an eBGP peer and craft malicious BGP UPDATEs that exploit the buffer calculation flaw. Successful exploitation requires the target to have multipath configured and be accepting labeled‑unicast UPDATEs from the malicious neighbor.