CVE-2025-21600: Juniper Junos BGP DoS Vulnerability

CVE-2025-21600 Overview

CVE-2025-21600 is an Out-of-Bounds Read vulnerability [CWE-125] in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. An unauthenticated, logically adjacent BGP peer can send a specifically malformed BGP packet that causes rpd to crash and restart. Continued receipt of the packet creates a sustained Denial of Service (DoS) condition on the affected router.

The issue affects both iBGP and eBGP sessions across any address family, including IPv4 and IPv6. Only systems with BGP traceoptions enabled or with BGP family traffic-engineering (BGP-LS) configured are vulnerable. This flaw is similar to, but distinct from, CVE-2024-39516.

Critical Impact
A single directly connected, configured BGP peer can repeatedly crash rpd, disrupting all routing on the device and causing sustained network-wide service disruption.

Affected Products

Juniper Junos OS: 21.4 before 21.4R3-S9, 22.2 before 22.2R3-S5, 22.3 before 22.3R3-S4, 22.4 before 22.4R3-S5, 23.2 before 23.2R2-S3, 23.4 before 23.4R2-S3, 24.2 before 24.2R1-S2 / 24.2R2
Juniper Junos OS Evolved: 21.4-EVO before 21.4R3-S9-EVO, 22.2-EVO before 22.2R3-S5-EVO, 22.3-EVO before 22.3R3-S4-EVO, 22.4-EVO before 22.4R3-S5-EVO, 23.2-EVO before 23.2R2-S3-EVO, 23.4-EVO before 23.4R2-S2-EVO, 24.2-EVO before 24.2R1-S2-EVO / 24.2R2-EVO
Versions of Junos OS and Junos OS Evolved prior to 21.3R1 are not affected

Discovery Timeline

2025-01-09 - CVE-2025-21600 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-21600

Vulnerability Analysis

The vulnerability resides in the rpd process, which handles all routing protocols on Junos OS and Junos OS Evolved. When rpd parses a specifically malformed BGP packet under two specific configurations, it performs a read beyond an intended buffer boundary. The unhandled memory access crashes the daemon, forcing an automatic restart.

Because rpd owns BGP, OSPF, IS-IS, and other protocol state, its restart tears down all routing adjacencies on the device. If the malformed packet is retransmitted, rpd enters a crash-and-restart loop, producing sustained routing outages until the offending session is blocked or upstream filtering is applied.

The issue affects both iBGP and eBGP sessions and applies to every configured address family. Both IPv4 and IPv6 transport are vulnerable. Exploitation requires an established, configured BGP peering relationship, which limits the attack surface to adjacent peers.

Root Cause

The defect is an Out-of-Bounds Read [CWE-125] in the BGP message handling path within rpd. Missing or incorrect bounds validation allows a crafted BGP message to trigger the read past allocated memory. The condition is only reachable when BGP traceoptions are enabled or BGP-LS (family traffic-engineering) is configured, both of which activate the vulnerable parsing code path.

Attack Vector

The attack originates from a logically adjacent, configured BGP peer. No authentication beyond the existing BGP session is required. The attacker sends a specifically malformed BGP packet across the peering session. Successful exploitation crashes rpd, and repeated packets sustain the DoS condition. No confidentiality or integrity impact is documented; the effect is limited to availability of routing services.

Because the vulnerable code path is gated by traceoptions (typically enabled during debugging) or BGP-LS (used for traffic engineering and SDN controllers), operators using these features on internet-facing or transit routers face the highest exposure.

Detection Methods for CVE-2025-21600

Indicators of Compromise

Unexpected rpd process crashes or core files on Junos devices, visible via show system core-dumps and syslog entries referencing rpd exit or restart
Sudden loss of BGP adjacencies across multiple peers coincident with a single misbehaving neighbor
Repeated BGP session flaps originating from the same peer address in messages or rpd trace logs

Detection Strategies

Audit configurations for protocols bgp traceoptions and family traffic-engineering to identify devices exposed to the vulnerable code path
Correlate rpd restart events with BGP UPDATE or OPEN messages received immediately before the crash using trace logs
Compare running Junos OS and Junos OS Evolved versions against the fixed release list from Juniper advisory JSA92870

Monitoring Recommendations

Forward Junos syslog and rpd trace output to a centralized log platform and alert on repeated rpd restarts within short intervals
Monitor BGP session state changes via SNMP or streaming telemetry and flag flap storms sourced from a single peer
Track core-dump generation on routing engines as a high-severity signal for the SOC and network operations team

How to Mitigate CVE-2025-21600

Immediate Actions Required

Upgrade Junos OS and Junos OS Evolved to a fixed release listed in Juniper advisory JSA92870
Where upgrade is not immediately feasible, disable BGP traceoptions and remove BGP family traffic-engineering (BGP-LS) configuration if operationally acceptable
Review BGP peer authentication and validate that only trusted, expected peers have configured sessions on affected devices

Patch Information

Juniper has released fixed versions in Junos OS 21.4R3-S9, 22.2R3-S5, 22.3R3-S4, 22.4R3-S5, 23.2R2-S3, 23.4R2-S3, 24.2R1-S2, 24.2R2, and later. Corresponding Junos OS Evolved fixes are available in 21.4R3-S9-EVO, 22.2R3-S5-EVO, 22.3R3-S4-EVO, 22.4R3-S5-EVO, 23.2R2-S3-EVO, 23.4R2-S2-EVO, 24.2R1-S2-EVO, 24.2R2-EVO, and later. Full guidance is available in the Juniper Security Advisory JSA92870.

Workarounds

Disable BGP traceoptions on all affected devices unless actively required for debugging
Remove BGP-LS by deleting family traffic-engineering from the BGP configuration where not required by traffic engineering or SDN controllers
Enforce strict peer filtering and BGP session authentication (authentication-key / TCP-AO) to reduce risk from a compromised or misconfigured neighbor

bash

# Configuration example: remove exposure to the vulnerable code path
# Disable BGP traceoptions
delete protocols bgp traceoptions

# Remove BGP-LS (traffic-engineering) address family from BGP groups/neighbors
delete protocols bgp group <group-name> family traffic-engineering

commit