CVE-2024-39552: Juniper Junos BGP DoS Vulnerability

CVE-2024-39552 Overview

CVE-2024-39552 is an Improper Handling of Exceptional Conditions vulnerability [CWE-755] in the routing protocol daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved. A network-based, unauthenticated attacker can crash RPD by sending a malformed Border Gateway Protocol (BGP) UPDATE packet over an established BGP session. The daemon restarts after each crash, and continuous receipt of malformed UPDATE messages produces a sustained Denial of Service (DoS) condition. The issue affects both external BGP (eBGP) and internal BGP (iBGP) sessions, across IPv4 and IPv6. Exploitation requires the attacker to already have at least one established BGP session with the target device.

Critical Impact
Sustained crashes of the routing protocol daemon disrupt BGP peering and route processing, causing prolonged network outages on affected Juniper routing platforms.

Affected Products

Juniper Networks Junos OS — all versions earlier than 20.4R3-S9, and 21.2, 21.3, 21.4, 22.1, 22.2, 22.3, 22.4, 23.2 prior to their respective fixed releases
Juniper Networks Junos OS Evolved — all versions earlier than 21.2R3-S7, and 21.3-EVO through 23.2-EVO prior to their respective fixed releases
Devices running BGP (eBGP or iBGP) over IPv4 or IPv6 with at least one established peer

Discovery Timeline

2024-07-11 - CVE-2024-39552 published to the National Vulnerability Database (NVD)
2026-01-23 - Last updated in NVD database

Technical Details for CVE-2024-39552

Vulnerability Analysis

The vulnerability resides in the RPD process, which implements BGP and other routing protocols on Junos OS and Junos OS Evolved. When RPD parses a malformed BGP UPDATE message received from an established peer, it fails to handle the exceptional condition and crashes. Junos automatically restarts RPD, but each restart tears down BGP sessions, flushes adjacencies, and triggers route reconvergence. An attacker who repeatedly sends the malformed UPDATE produces a crash loop, preventing the device from maintaining stable routing state. The result is loss of forwarding for prefixes learned via BGP and degraded availability for transit traffic.

Root Cause

The defect maps to CWE-755, Improper Handling of Exceptional Conditions. RPD does not validate or safely reject specific malformed fields in a BGP UPDATE before they reach code paths that assume well-formed input. Instead of generating a NOTIFICATION and resetting only the offending session per RFC 4271 error handling, the daemon enters an unrecoverable state and terminates.

Attack Vector

The attack vector is network-based and requires no authentication beyond a pre-existing BGP session. A compromised or misconfigured BGP peer, a malicious upstream provider, or any peer reachable through transitive BGP propagation could send the crafted UPDATE. Because BGP sessions traverse trust boundaries between autonomous systems, eBGP exposure extends the attack surface to peers outside the operator's administrative control. No code examples are released; refer to the Juniper Security Advisory JSA75726 for vendor technical detail.

Detection Methods for CVE-2024-39552

Indicators of Compromise

Repeated RPD process crashes or restart events in Junos system logs, often correlated with received BGP UPDATE messages
Unexpected BGP session flaps across multiple peers within a short window
Core files generated by RPD and traceback entries referencing BGP UPDATE parsing
Sudden withdrawal and re-advertisement of large numbers of prefixes from the local device

Detection Strategies

Monitor RPD daemon health using show system processes extensive and SNMP process-monitoring MIBs for unexpected restarts
Alert on BGP state transitions from Established to Idle or Active across multiple peers, indicating session resets after a crash
Forward Junos syslog events such as RPD_ABORT, RPD_TASK_REINIT, and BGP NOTIFICATION messages to a centralized log platform for correlation

Monitoring Recommendations

Centralize routing platform telemetry and Junos syslog in a SIEM or data lake for cross-device correlation of RPD instability
Baseline normal BGP session flap rates per peer so anomalous bursts trigger investigation
Track BGP UPDATE message rates and NOTIFICATION codes per neighbor to identify peers sending malformed traffic

How to Mitigate CVE-2024-39552

Immediate Actions Required

Inventory all Junos OS and Junos OS Evolved devices and identify those running BGP with versions listed as affected
Schedule upgrades to the fixed releases: Junos OS 20.4R3-S9, 21.2R3-S7, 21.3R3-S5, 21.4R3-S6, 22.1R3-S4, 22.2R3-S3, 22.3R3-S2, 22.4R3, 23.2R2, or later; Junos OS Evolved 21.2R3-S7, 21.3R3-S5, 21.4R3-S8, 22.1R3-S4, 22.2R3-S3, 22.3R3-S2, 22.4R3, 23.2R2-EVO, or later
Restrict and authenticate BGP peers using TCP-AO or MD5, and validate that only intended ASNs can establish sessions
Review RPD core files and BGP session logs for prior signs of exploitation

Patch Information

Juniper published fixed software releases in Juniper Security Advisory JSA75726. Operators should upgrade to the listed fixed release for their train, or to any later release where the fix is rolled forward. There is no software-only workaround that fully neutralizes the issue without the patch.

Workarounds

Apply strict BGP import policies and prefix filters to limit what attributes and prefixes are accepted from peers, reducing exposure to malformed input
Use BGP session authentication and infrastructure access control lists to limit which hosts can establish BGP sessions to the router
For peers known to send anomalous traffic, administratively disable the session until upgrades are completed

bash

# Example: verify Junos version and identify BGP peers prior to upgrade
show version | match Junos
show bgp summary
show system processes extensive | match rpd