Junos OS and Junos OS Evolved: With BGP sharding enabled, change in indirect next-hop can cause RPD crash

CVE-2025-59962

What is CVE-2025-59962?

An Access of Uninitialized Pointer vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved with BGP sharding configured allows an attacker triggering indirect next-hop updates, along with timing outside the attacker's control, to cause rpd to crash and restart, leading to a Denial of Service (DoS).

With BGP sharding enabled, triggering route resolution of an indirect next-hop (e.g., an IGP route change over which a BGP route gets resolved), may cause rpd to crash and restart. An attacker causing continuous IGP route churn, resulting in repeated route re-resolution, will increase the likelihood of triggering this issue, leading to a potentially extended DoS condition.

This issue affects:

Junos OS:

• all versions before 21.4R3-S6, 
• from 22.1 before 22.1R3-S6, 
• from 22.2 before 22.2R3-S3, 
• from 22.3 before 22.3R3-S3, 
• from 22.4 before 22.4R3, 
• from 23.2 before 23.2R2; 

Junos OS Evolved: 

• all versions before 22.3R3-S3-EVO, 
• from 22.4 before 22.4R3-EVO, 
• from 23.2 before 23.2R2-EVO.

Versions before Junos OS 21.3R1 and Junos OS Evolved 21.3R1-EVO are unaffected by this issue.

References