The vulnerability in Juniper’s routing protocol daemon stems from an improper validation of a specified quantity in input data. A malformed SRv6 structure carried in an EVPN route update can trigger the daemon to crash, causing a denial of service that disrupts routing adjacencies. The flaw leads to a software crash rather than direct code execution.

Juniper Networks products affected are Junos OS and Junos OS Evolved. All releases listed by the vendor in the advisory – 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1 – and their Evolved counterparts (23.4R2‑S8.11‑EVO, 24.2R2‑S5.6‑EVO, 24.4R2‑S5‑EVO, 25.2R2‑S2‑EVO, 25.2X100‑D35‑EVO, 25.4R1‑S3‑EVO, 25.4R2‑EVO, 25.4X300‑D40‑EVO, 26.2R1‑S2‑EVO, 26.2R2‑EVO, 26.4R1‑EVO, and all subsequent releases.

The flaw carries a CVSS score of 8.7, indicating high severity. The EPSS score of less than 1% suggests a very low but non‑zero probability that the vulnerability will be publicly exploited. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need to insert a malformed SRv6 route update into the EVPN signaling stream, which implies they must control or compromise a signaling peer or have the ability to inject traffic into the peer’s channel. With no publicly known exploits, the likelihood remains low, but the consequence of a routing crash justifies immediate remediation.