An incomplete list of disallowed inputs in the routing protocol daemon of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to craft a specific, valid optional, non‑transitive BGP update that crashes rpd. The crash triggers an automatic restart of the daemon, causing a temporary loss of routing control and halting traffic until the router reconverges. The principal effect is an interrupt in network service availability on the affected device.

Juniper Networks Junos OS and Junos OS Evolved devices running any version prior to the patched releases are vulnerable. For Junos OS, this includes all releases before 23.2R2‑S6, 23.4R2‑S7, 24.2R2‑S4, 24.4R2‑S4, 25.2R1‑S2, and 25.2R2. For Junos OS Evolved, the affected versions are all releases before 23.2R2‑S6‑EVO, 23.4R2‑S8.11‑EVO, 24.2R2‑S4‑EVO, 24.4R2‑S5‑EVO, 25.2R1‑S2‑EVO, and 25.2R2‑EVO.

The CVSS score of 7.1 indicates moderate‑to‑high severity, while the EPSS score of less than 1% points to a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attacker must be a neighboring BGP speaker, establishing a session, but no additional credentials are required. Sending the malformed BGP update directly triggers the crash; the required conditions are minimal and readily satisfied by an adjacent adversary.