CVE-2025-21597: Juniper Junos BGP DoS Vulnerability

CVE-2025-21597 Overview

CVE-2025-21597 is a denial-of-service vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. The flaw stems from an Improper Check for Unusual or Exceptional Conditions [CWE-754] triggered when BGP rib-sharding and update-threading are configured. A logically adjacent, unauthenticated BGP peer can cause rpd to crash and restart by flapping a BGP session with specific timing. Continuous peer flapping produces a sustained outage. The issue affects both eBGP and iBGP over IPv4 and IPv6, with or without logical-systems enabled, and requires the attacker to hold at least one established BGP session with the target device.

Critical Impact
A single BGP peer can repeatedly crash the routing daemon on affected Junos OS and Junos OS Evolved routers, disrupting routing convergence across the network.

Affected Products

Juniper Junos OS (all versions before 20.4R3-S8, and 21.2, 21.3, 21.4, 22.1, 22.2, 22.3, 22.4 branches before the fixed service releases)
Juniper Junos OS Evolved (all 21.2-EVO, 21.3-EVO, 21.4-EVO, 22.1-EVO, 22.2-EVO, 22.3-EVO, 22.4-EVO branches before the fixed service releases)
Any Junos platform configured with BGP rib-sharding and update-threading

Discovery Timeline

2025-04-09 - CVE-2025-21597 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-21597

Vulnerability Analysis

The vulnerability lives in the routing protocol daemon (rpd), which handles BGP session state on Junos platforms. When rib-sharding and update-threading are both enabled, BGP state changes are processed across multiple worker threads that share update queues. rpd fails to correctly validate the state of shared resources during specific BGP peer transition timings, resulting in a crash and process restart. Because rpd owns all routing protocol state, its restart tears down BGP, OSPF, IS-IS, and other adjacencies until the daemon converges again.

An attacker who controls a single established BGP peer can weaponize this behavior. By repeatedly flapping the session at the precise interval that hits the race window, the attacker keeps rpd in a crash-restart loop and produces a sustained denial of service. The condition is protocol-agnostic between eBGP and iBGP and works for both IPv4 and IPv6 address families.

Root Cause

The defect is classified as CWE-754: Improper Check for Unusual or Exceptional Conditions. The sharded update path assumes ordered, well-formed session state transitions. When a peer flap occurs during a narrow timing window in the update-threading pipeline, rpd reaches an exceptional state it does not handle, dereferences invalid state, and terminates.

Attack Vector

Exploitation requires logical adjacency, meaning the attacker must terminate a BGP session with the target. No authentication beyond the standard BGP peering configuration is required. The attacker only needs to bring the session up and down repeatedly with the right cadence. There is no need for crafted BGP messages, malformed updates, or elevated capabilities on the peer side, which makes this trivially reproducible from any compromised or misconfigured peer router. Refer to the Juniper Security Advisory JSA96451 for the vendor's technical description.

Detection Methods for CVE-2025-21597

Indicators of Compromise

Repeated rpd process restarts recorded in /var/log/messages or via show system core-dumps
Frequent BGP session state transitions (Established → Idle → Established) from the same peer over short intervals
SNMP traps or syslog entries showing RPD_START, RPD_ABORT, or BGP_NEIGHBOR_STATE_CHANGED in rapid succession
Routing table churn and traffic loss correlating with peer flap events

Detection Strategies

Alert on any rpd core file generation on Junos or Junos Evolved devices running BGP with rib-sharding and update-threading
Baseline BGP session stability per peer and trigger on flap counts exceeding a low threshold within a short window
Correlate rpd restart events with the source peer that initiated the last state change to identify likely attackers

Monitoring Recommendations

Forward Junos syslog to a centralized SIEM or data lake and build detections for rpd, RPD_TASK, and BGP state-change facilities
Track BGP peer flap counters with show bgp neighbor and streaming telemetry (gNMI or Junos Telemetry Interface)
Monitor control-plane CPU, memory, and daemon uptime for anomalies consistent with rpd restarts

How to Mitigate CVE-2025-21597

Immediate Actions Required

Identify all Junos OS and Junos OS Evolved devices with BGP rib-sharding and update-threading enabled
Upgrade to a fixed Junos OS or Junos OS Evolved release as listed in JSA96451
Restrict BGP peering to authenticated, trusted neighbors and apply peer-level rate limits where supported
Review recent rpd core files and syslog history for signs of prior exploitation attempts

Patch Information

Juniper has released fixes in Junos OS 20.4R3-S8, 21.2R3-S6, 21.3R3-S5, 21.4R3-S4, 22.1R3-S3, 22.2R3-S1, 22.3R3, 22.4R3, and later. Junos OS Evolved fixes are available in 21.2R3-S6-EVO, 21.3R3-S5-EVO, 21.4R3-S4-EVO, 22.1R3-S3-EVO, 22.2R3-S1-EVO, 22.3R3-EVO, 22.4R3-EVO, and later. Consult the Juniper Security Advisory JSA96451 for the authoritative fixed-release matrix.

Workarounds

Disable BGP rib-sharding and/or update-threading until the device can be upgraded, accepting the associated performance trade-off
Enforce BGP session authentication and apply infrastructure ACLs so only known peers can establish sessions with the router
Use BGP session damping and peer-group policies to limit the impact of rapid flaps from a misbehaving neighbor

bash

# Example: remove the vulnerable configuration combination on Junos
configure
delete routing-options rib-sharding
delete protocols bgp update-threading
commit and-quit

# Verify rpd stability and BGP peer flap counts after change
show system processes extensive | match rpd
show bgp summary
show bgp neighbor | match "flap|Last State"