A NULL Pointer Dereference in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote BGP peer to crash rpd when multiple UPDATE messages are transmitted over a single TCP session with the "bgp family l2vpn auto-discovery-only" statement enabled. The crash causes the device to become unavailable, resulting in a denial of service that affects network connectivity and routing stability.

Affected devices run Junos OS or Junos OS Evolved before the patched releases listed in the advisory. The vendor lists 23.2R2‑S7.7, 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1 and all subsequent releases for Junos OS, and 23.2R2‑S7.7‑EVO, 23.4R2‑S8.11‑EVO, 24.2R2‑S5.6‑EVO, 24.4R2‑S5‑EVO, 25.2R2‑S2‑EVO, 25.2X100‑D35‑EVO, 25.4R1‑S3‑EVO, 25.4R2‑EVO, 25.4X300‑D40‑EVO, 26.2R1‑S2‑EVO, 26.2R2‑EVO, 26.4R1‑EVO and all subsequent releases for Junos OS Evolved. Earlier releases (23.2, 23.4, 24.2 and the corresponding EVOs) are addressed by specific respins.

The CVSS score of 8.7 marks this as a high severity vulnerability, and the EPSS score of less than 1% indicates a low but existent probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker only needs to control a remote BGP peer and send crafted UPDATE packets within a session that has auto-discovery enabled; no authentication or local privilege escalation is required. Because the condition relies on a network configuration (auto‑discovery) that is commonly enabled in multi‑access or data center environments, exposed devices are at risk if an attacker can communicate with the BGP session.