A reachable assertion flaw in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent network attacker to inject malformed RSVP signaling messages, causing the routing daemon to crash and leading to a denial of service by disrupting routing processes. The flaw specifically triggers a crash when RSVP is enabled, resulting in loss of routing information and potential network outages.

Affected systems include Juniper Networks’ Junos OS and Junos OS Evolved running any version before the releases mentioned in the advisory, such as Junos OS 23.2R2‑S7.7 and earlier, 23.4R2‑S8.13 and earlier, 24.2R2‑S5.5 and earlier, 24.4R2‑S5 and earlier, 25.2R2‑S2 and earlier, 25.4R1‑S3 and earlier, 25.4R2 and earlier, 26.2R1‑S2 and earlier, 26.2R2 and earlier, 26.4R1 and earlier; for Junos OS Evolved the same applies to releases before 23.2R2‑S7.7‑EVO, 23.4R2‑S8.11‑EVO, 24.2R2‑S5.6‑EVO, 24.4R2‑S5‑EVO, 25.2R2‑S2‑EVO, 25.2X100‑D35‑EVO, 25.4R1‑S3‑EVO, 25.4R2‑EVO, 25.4X300‑D40‑EVO, 26.2R1‑S2‑EVO, 26.2R2‑EVO, 26.4R1‑EVO that lack the fix.

The vulnerability carries a CVSS score of 7.1, indicating moderate to high severity. EPSS is not available, so the precise current exploitation probability is unknown, though the absence of a KEV listing suggests no widespread active exploitation is documented. The likely attack vector involves an adjacent unauthenticated network user sending crafted RSVP messages; successful exploitation requires RSVP to be enabled on the target device. Once triggered, the attack achieves denial of service by crashing the routing daemon without granting any additional privileges or data access.