Juniper’s Junos OS and Junos OS Evolved contain a reachable assertion bug in the rpd process that can be triggered by a configured BGP‑LS peer. When a BGP‑LS update reaches the vulnerable process, the assertion fails and causes the control‑plane components to crash, resulting in a loss of routing functionality for the element. The flaw is a classic assertion violation (CWE‑617) and directly compromises the availability of the routing protocol stack.

The following software families are affected: Juniper Networks’ Junos OS and Junos OS Evolved. The vendor released patched builds that resolve the issue, including all versions from 23.2R2‑S7.7 up through 26.4R1 and all subsequent releases for Junos OS, and the corresponding V5‑EVO, V8‑EVO, V6‑EVO, R1‑EVO, R2‑EVO, and R4‑EVO series for Junos OS Evolved. No known workarounds are available at the time of this advisory.

The vulnerability carries a CVSS score of 8.7, indicating high severity. EPSS data is not available and the flaw is not listed in CISA’s KEV catalog. An attacker must be a legitimate BGP‑LS peer, which typically requires internal or trusted network access. While this limits the exposure surface, the potential impact is a complete denial of routing services on the affected device, which can ripple through an entire network segment.