The vulnerability is a NULL Pointer Dereference in Juniper's routing protocol daemon (rpd). A remote BGP peer can trigger it by sending multiple UPDATE messages over a single TCP session when the "bgp family l2vpn auto-discovery-only" statement is enabled, causing rpd to crash and the device to become unavailable.

The issue affects Juniper Networks Junos OS and Junos OS Evolved devices running versions before the patched releases listed in the vendor's advisory. The advisory lists that Junos OS releases 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1 and all subsequent releases are fully patched; similarly, Junos OS Evolved releases 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO and all subsequent releases are also patched. Earlier 23.2, 23.4 and 24.2 releases and their EVOs are covered by specific respins referenced in the advisory text.

The CVSS score of 8.7 indicates a high severity denial of service vulnerability. With no EPSS score available and no KEV listing, the exact current exploitation probability remains unknown, but the lack of a workaround means that any exposed device running an affected rpd version and participating in a BGP session with auto‑discovery enabled is at risk. The attacker requires only remote control of a BGP peer to send crafted UPDATE packets; no local privilege escalation or authentication is needed.