A reachable assertion flaw in Juniper’s routing protocol daemon (rpd) allows an unauthenticated attacker to send a crafted eBGP route update when HFRR link protection is enabled, causing the daemon to crash and the router to become unavailable. The resulting denial of service disrupts routing services and network connectivity for the affected device.

Juniper Networks Junos OS on MX Series routers with HFRR link protection configured in a VRF are affected. Versions not listed in the official patch release list are potentially vulnerable. The patched releases, which resolve the issue, are Junos OS: 23.2R2‑S7.7, 23.4R2‑S8.13, 24.2R2‑S5.5, 24.2R2‑S6, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1, and all subsequent releases.

The CVSS base score of 7.1 classifies this flaw as high severity, and the EPSS score of < 1% indicates a very low probability of exploitation based on current threat data. However, because the attacker only needs to send a BGP packet over an unauthenticated session, the potential for a denial of service on a network that relies on HFRR is significant if the device is running a vulnerable firmware version. The vulnerability is not listed in CISA’s KEV catalog. No workaround is available; immediate patching is required.