A numeric truncation error in the routing daemon process of Juniper’s Junos OS and Junos OS Evolved allows an unauthenticated attacker to crash the daemon by advertising a BGP Prefix‑SID route that is later re‑advertised. The result is a denial of service that can disrupt routing intelligence on the device, potentially impacting network reachability and service availability for all hosts that use the affected router.

The vulnerability affects Juniper Networks Junos OS and Junos OS Evolved releases from 20.4R1 onward. The patch addresses all listed releases: Junos OS 23.2R2‑S7.7, 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1, and all subsequent releases; and Junos OS Evolved 23.2R2‑S7.7‑EVO, 23.4R2‑S8.11‑EVO, 24.2R2‑S5.6‑EVO, 24.4R2‑S5‑EVO, 25.2R2‑S2‑EVO, 25.2X100‑D35‑EVO, 25.4R1‑S3‑EVO, 25.4R2‑EVO, 25.4X300‑D40‑EVO, 26.2R1‑S2‑EVO, 26.2R2‑EVO, 26.4R1‑EVO, and all subsequent releases. Versions prior to 20.4R1 or 20.4R1‑EVO are not affected.

With a CVSS score of 8.7 the vulnerability is considered high severity. EPSS score of 0.00373 indicates a very low but non‑zero exploitation probability, suggesting that while the vulnerability is still high in severity, public exploitation may be uncommon. The issue is not listed in CISA’s KEV catalog. The flaw requires an unauthenticated network attacker to inject a malicious BGP Prefix‑SID announcement; the absence of authentication for BGP session and the ability to re‑advertise the route give the attacker a low‑barrier attack vector to bring the routing daemon down, making this a prominent threat for routers that participate in unfiltered BGP flooding.