The bfdd daemon in Juniper Networks Junos OS and Junos OS Evolved contains a reachable assertion, which is a CWE-617 weakness. This assertion can be triggered by an unauthenticated attacker on the same network segment who sends specially crafted BFD session traffic. When the assertion fires, the bfdd process crashes and automatically restarts, resulting in a denial of service for any services that rely on BFD. The vulnerability allows the attacker to interrupt traffic engineering and network monitoring functions without compromising data or gaining further access.

Juniper Networks Junos OS and Junos OS Evolved are affected, including all releases listed in the advisory: Junos OS 23.2R2-S7.7 through 26.4R1 and later, and Junos OS Evolved 23.2R2-S7.7-EVO through 26.4R1-EVO and later. Specific respins for the 23.2, 23.4, and 24.2 series have been rebuilt to address the issue.

The CVSS score of 7.1 places this vulnerability in the high range, the EPSS score is <1% indicating a very low but nonzero exploitation probability, and it is not listed in CISA’s KEV catalog. The likely attack vector is local network access to the affected device, and no authentication is required. The impact is limited to service availability; the attacker cannot read, modify, or delete data. Because the flaw is triggered by crafted BFD packets, an attacker could repeatedly crash the daemon, causing persistent outages until a patch is applied.