An Incorrect Calculation of Buffer Size vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a memory corruption that leads to an rpd crash. This issue can result in a sustained Denial of Service condition when specific updates are continuously sent to the jflow/sflow modules. Affected versions include various releases prior to specific patches across multiple Junos OS versions.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.1 | CVE-2025-52955 |
Exploitation
To exploit this vulnerability, an attacker on the adjacent network can continuously send specific updates to the jflow/sflow modules, causing the routing protocol daemon (rpd) to crash and restart. This can lead to a Denial of Service condition, affecting the availability of the routing services.
Affected Products
- Junos OS: All versions before 21.2R3-S9, all versions of 21.4, 22.2, from 22.4 before 22.4R3-S7, from 23.2 before 23.2R2-S3, from 23.4 before 23.4R2-S4, from 24.2 before 24.2R2.
- Junos OS Evolved: All versions of 21.2-EVO, 21.4-EVO, 22.2-EVO, from 22.4 before 22.4R3-S7-EVO, from 23.2 before 23.2R2-S3-EVO, from 23.4 before 23.4R2-S4-EVO, from 24.2 before 24.2R2-EVO.
Mitigation
To mitigate this vulnerability, users should upgrade to the patched versions of Junos OS and Junos OS Evolved as specified in the vendor’s advisory. Regular monitoring and updates of network devices can help prevent exploitation.