CVE-2025-21593: Juniper Junos SRv6 BGP DoS Vulnerability

CVE-2025-21593 Overview

CVE-2025-21593 is a denial-of-service vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. An unauthenticated adjacent attacker can send a malformed Border Gateway Protocol (BGP) UPDATE packet to a device with Segment Routing over IPv6 (SRv6) enabled. The malformed packet crashes the rpd process, which restarts. Continued receipt of these packets produces a sustained denial-of-service condition. The issue affects both internal BGP (iBGP) and external BGP (eBGP) sessions across IPv4 and IPv6 address families. The Common Weakness Enumeration classification is [CWE-664] Improper Control of a Resource Through its Lifetime.

Critical Impact
A single malformed BGP UPDATE from a peer can crash the rpd daemon on SRv6-enabled Juniper routers, causing repeated routing failures and sustained network outages.

Affected Products

Juniper Junos OS (all versions before 21.2R3-S9, and multiple 21.4, 22.2, 22.3, 22.4, 23.2, and 23.4 releases)
Juniper Junos OS Evolved (all versions before 21.2R3-S9-EVO, and multiple 21.4-EVO through 23.4-EVO releases)
Devices with SRv6 (Segment Routing over IPv6) enabled and BGP peering configured

Discovery Timeline

2025-01-09 - CVE-2025-21593 published to NVD and Juniper releases advisory JSA92861
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-21593

Vulnerability Analysis

The routing protocol daemon rpd is the central process on Junos OS that handles BGP, OSPF, IS-IS, and other routing protocols. This flaw is a resource lifecycle defect triggered during BGP UPDATE message processing on devices configured with SRv6. When the daemon parses a malformed UPDATE, it terminates unexpectedly and restarts. Every restart tears down active BGP sessions, flushes routing state, and forces neighbors to re-establish adjacencies. Repeated malformed UPDATEs turn a transient crash into a persistent outage that removes the router from active packet forwarding participation.

Root Cause

The root cause is improper control of a resource through its lifetime [CWE-664] in the SRv6-aware BGP UPDATE processing path within rpd. The daemon fails to safely validate or manage a resource associated with the malformed attribute before continuing to use it, producing a fatal error. Because the crashing code path is reached during normal protocol handling, no authentication or session state manipulation is required beyond the ability to send BGP messages toward the router.

Attack Vector

Exploitation requires network adjacency to a BGP peer of the vulnerable router. In an eBGP scenario, any peer that can establish a session with the target can send the crafted UPDATE. In an iBGP scenario, an attacker who has already compromised an internal peer or gained access to the routing domain can trigger the same crash. Both IPv4 and IPv6 address families are impacted. The vulnerability manifests only when SRv6 is enabled on the target device. No verified public proof-of-concept code is available, and no exploitation in the wild has been reported.

Detection Methods for CVE-2025-21593

Indicators of Compromise

Repeated rpd process restarts logged in /var/log/messages or the Junos system log.
Flapping BGP sessions with peers, particularly correlated with received UPDATE messages containing SRv6-related attributes.
Core files generated by rpd following BGP UPDATE processing.
Sudden loss of installed BGP routes followed by re-learning cycles.

Detection Strategies

Monitor rpd daemon health with SNMP or streaming telemetry and alert on unexpected restarts.
Correlate BGP session state changes (BGP_TRANSPORT_CLOSED, BGP_NEIGHBOR_STATE_CHANGED) with routing daemon events.
Inspect BGP UPDATE traffic at network boundaries for anomalous attribute lengths or malformed SRv6 SID structures using a network analyzer.

Monitoring Recommendations

Forward Junos syslog to a centralized log platform and build alerts for rpd restart patterns.
Track BGP prefix count deltas per peer to identify sudden withdrawals that coincide with rpd failures.
Baseline expected BGP UPDATE rates from each peer and alert on deviations that may indicate crafted-packet injection.

How to Mitigate CVE-2025-21593

Immediate Actions Required

Inventory Junos OS and Junos OS Evolved devices and identify those running affected versions with SRv6 enabled.
Upgrade affected devices to a fixed release listed in Juniper Security Advisory JSA92861.
Restrict BGP peering to trusted, authenticated neighbors and validate that peer filters are in place.
If SRv6 is not required, evaluate disabling it until patches can be deployed.

Patch Information

Juniper has released fixed versions per Juniper Security Advisory JSA92861. For Junos OS, upgrade to 21.2R3-S9, 21.4R3-S10, 22.2R3-S5, 22.3R3-S4, 22.4R3-S3, 23.2R2-S2, 23.4R2, or later. For Junos OS Evolved, upgrade to the equivalent -EVO releases: 21.2R3-S9-EVO, 21.4R3-S10-EVO, 22.2R3-S5-EVO, 22.3R3-S4-EVO, 22.4R3-S3-EVO, 23.2R2-S2-EVO, or 23.4R2-EVO.

Workarounds

Disable SRv6 on BGP-speaking routers where it is not operationally required, which removes the vulnerable code path.
Apply strict BGP inbound policies and use MD5 or TCP-AO authentication on BGP sessions to reduce exposure to untrusted peers.
Enforce infrastructure access control lists that limit BGP (TCP/179) reachability to known peer addresses only.

bash

# Verify current Junos version and SRv6 configuration state
show version
show configuration routing-options source-packet-routing
show bgp summary