A numeric truncation error in the routing process daemon (rpd) allows an adjacent attacker to crash the process by exploiting MPLS-TE fast-reroute signaling. The flaw can be triggered by adjacent devices that send malformed fast-reroute messages, resulting in a denial of service that disconnects routing services. This vulnerability is categorized as CWE-197, which indicates a failure in handling numeric values properly.

The flaw affects Juniper Networks Junos OS and Junos OS Evolved. All releases before Junos OS 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1 and their equivalents in Junos OS Evolved including 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6‑EVO, 24.4R2‑S5‑EVO, 25.2R2‑S2‑EVO, 25.2X100‑D35‑EVO, 25.4R1‑S3‑EVO, 25.4R2‑EVO, 25.4X300‑D40‑EVO, 26.2R1‑S2‑EVO, 26.2R2‑EVO, 26.4R1‑EVO and all subsequent releases. Prior respins have also been rebuilt with the fix. No workaround is provided by Juniper.

The CVSS score of 7.1 signals a high‑severity vulnerability. The EPSS score is < 1%, indicating a very low likelihood of exploitation. The lack of a known workaround and the requirement for an adjacent device to send malformed MPLS‑TE fast‑reroute messages suggest that exploitation would be limited to local or trusted network peers. The vulnerability is not listed in the CISA KEV catalog, implying no confirmed widespread active exploitation yet. Nonetheless, the potential for routing disruption warrants prompt remediation.