A reachable assertion flaw in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to trigger a denial of service by sending a carefully crafted RSVP packet. The flaw leads to an rpd crash, interrupting routing functions and potentially affecting the availability of the device. This vulnerability corresponds to CWE‑617 (Reachable Assertion).

The affected product line is Juniper Networks’ Junos OS and Junos OS Evolved. Versions that contain the flaw include Junos OS releases from 23.2R2‑S7.7 onward, 23.4R2‑S8.13 onward, 24.2R2‑S5.5 onward, 24.4R2‑S5 onward, 25.2R2‑S2 onward, 25.4R1‑S3 onward, 25.4R2 onward, 26.2R1‑S2 onward, 26.2R2 onward, 26.4R1 onward, and all subsequent releases. Similarly, Junos OS Evolved releases from 23.2R2‑S7.7‑EVO onward, 23.4R2‑S8.11‑EVO onward, 24.2R2‑S5.6‑EVO onward, 24.4R2‑S5‑EVO onward, 25.2R2‑S2‑EVO onward, 25.2X100‑D35‑EVO onward, 25.4R1‑S3‑EVO onward, 25.4R2‑EVO onward, 25.4X300‑D40‑EVO onward, 26.2R1‑S2‑EVO onward, 26.2R2‑EVO onward, 26.4R1‑EVO onward, and all subsequent releases.

The CVSS score of 7.1 indicates a high risk, and the vulnerability is rated as a Denial of Service attack vector. The EPSS score indicates a very low exploitation probability of 0.27%, and the flaw is not listed in the CISA KEV catalog. The attack requires no authentication, but the attacker must be adjacent to the device to send the specific RSVP packet that triggers the reachable assertion. Without an available workaround, exposure remains until the device is updated to a patched release.