Use After Free Vulnerability in Juniper Networks Junos OS and Junos OS Evolved
CVE-2025-52946

8.7HIGH

Key Information:

Vendor
CVE Published:
11 July 2025

Badges

👾 Exploit Exists

What is CVE-2025-52946?

A Use After Free vulnerability exists in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. By sending a specifically malformed AS PATH in a BGP update, an attacker can trigger a crash of the rpd process, leading to Denial of Service (DoS). This condition persists as long as the malformed AS PATH is continuously received. The issue specifically affects systems where BGP traceoptions are enabled and a BGP session has been established. Systems without BGP traceoptions enabled remain unaffected. Updated patches are available to mitigate this issue, improving upon previous fixes.

Affected Version(s)

Junos OS 0 < 21.2R3-S9

Junos OS 21.4

Junos OS 22.2 < 22.2R3-S6

References

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-52946 : Use After Free Vulnerability in Juniper Networks Junos OS and Junos OS Evolved