CVE-2025-52949: Juniper Junos BGP EVPN DoS Vulnerability

CVE-2025-52949 Overview

CVE-2025-52949 is a denial-of-service vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. The flaw stems from improper handling of length parameter inconsistency [CWE-130] in BGP packet processing. A logically adjacent BGP peer can send a specifically malformed BGP packet that causes rpd to crash and restart. Continued receipt of the malicious packet produces a sustained outage. Only systems configured for Ethernet Virtual Private Networking (EVPN) signaling are affected. The issue impacts both iBGP and eBGP sessions across IPv4 and IPv6.

Critical Impact
A single malformed BGP packet from an adjacent peer crashes the rpd daemon, disrupting routing and creating a sustained denial-of-service condition on EVPN-enabled routers.

Affected Products

Juniper Junos OS: all versions before 21.4R3-S11; 22.2 before 22.2R3-S7; 22.4 before 22.4R3-S7; 23.2 before 23.2R2-S4; 23.4 before 23.4R2-S5; 24.2 before 24.2R2-S1; 24.4 before 24.4R1-S3 and 24.4R2
Juniper Junos OS Evolved: all versions before 22.2R3-S7-EVO; 22.4-EVO before 22.4R3-S7-EVO; 23.2-EVO before 23.2R2-S4-EVO; 23.4-EVO before 23.4R2-S5-EVO; 24.2-EVO before 24.2R2-S1-EVO; 24.4-EVO before 24.4R1-S3-EVO and 24.4R2-EVO
Systems configured with EVPN signaling for BGP (iBGP or eBGP, IPv4 or IPv6)

Discovery Timeline

2025-07-11 - CVE-2025-52949 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-52949

Vulnerability Analysis

The vulnerability resides in the BGP message parsing logic within rpd, the routing protocol daemon that handles all dynamic routing on Junos OS and Junos OS Evolved. When rpd processes a BGP UPDATE containing EVPN Network Layer Reachability Information (NLRI), it does not correctly reconcile the declared length fields with the actual payload data. This length parameter inconsistency [CWE-130] leads to an unrecoverable parsing error that terminates the daemon.

Because rpd owns BGP, OSPF, IS-IS, and other routing state, its restart tears down all peering sessions and re-converges routing tables. Continued receipt of the malformed packet triggers repeated crashes, producing a sustained denial-of-service condition against transit and edge routers used in EVPN fabrics.

Root Cause

The root cause is improper handling of length parameter inconsistency during BGP EVPN message parsing. When declared field lengths do not match the actual octets present in the packet, rpd fails to validate the mismatch safely and enters an unrecoverable error path. The bug only manifests on devices where EVPN signaling is configured, which narrows the exposed surface to service provider and data center fabrics using EVPN-VXLAN or EVPN-MPLS.

Attack Vector

Exploitation requires a logically adjacent BGP peer, meaning the attacker must control or compromise a device with an established BGP session to the target. Both iBGP and eBGP configurations are exploitable, and both IPv4 and IPv6 transport are affected. The attacker sends a single crafted BGP packet with malformed length fields in an EVPN NLRI. Because the exploit runs at the routing control plane, no authentication beyond the existing BGP session is required. Refer to the Juniper Security Advisory JSA100053 for further technical context.

// No public proof-of-concept is available. The vulnerability is triggered
// by a malformed BGP UPDATE containing EVPN NLRI with inconsistent
// length parameters, causing rpd to crash on parse.

Detection Methods for CVE-2025-52949

Indicators of Compromise

Unexpected rpd core files or crash log entries referencing BGP EVPN message processing
Repeated BGP session flaps or NOTIFICATION messages coinciding with rpd restarts
Loss of EVPN routes and MAC/IP advertisements immediately following peer traffic bursts
Syslog entries showing rpd process termination followed by automatic restart

Detection Strategies

Monitor /var/log/messages and /var/log/rpd for repeated rpd restart signatures and BGP peer resets
Correlate BGP session state changes with rpd process uptime metrics collected via SNMP or Junos telemetry
Baseline expected BGP UPDATE volume per peer and alert on abnormal EVPN NLRI traffic from a single neighbor

Monitoring Recommendations

Ingest Junos syslog and routing engine telemetry into a centralized analytics platform for correlation across the fabric
Track BGP peer flap counters and rpd restart counts as first-class SRE and SOC metrics
Alert on any rpd crash event on EVPN-enabled routers until all devices are patched

How to Mitigate CVE-2025-52949

Immediate Actions Required

Upgrade affected Junos OS and Junos OS Evolved devices to the fixed releases listed in JSA100053
Inventory routers with EVPN signaling enabled and prioritize patching those systems first
Restrict BGP peering to trusted, authenticated neighbors and validate BGP session integrity across the fabric

Patch Information

Juniper has released fixed versions in Junos OS 21.4R3-S11, 22.2R3-S7, 22.4R3-S7, 23.2R2-S4, 23.4R2-S5, 24.2R2-S1, 24.4R1-S3, and 24.4R2, along with the equivalent Junos OS Evolved builds. Full version guidance is documented in the Juniper Security Advisory JSA100053.

Workarounds

No feature-level workaround eliminates the flaw; only upgrading to a fixed release removes exposure
Where immediate upgrade is not possible, enforce strict BGP peer allow-lists and use infrastructure ACLs to limit which devices can establish BGP sessions
Disable EVPN signaling on routers that do not require it until patching is complete

bash

# Verify Junos OS version and identify EVPN-signaling configuration
show version
show configuration protocols evpn
show configuration protocols bgp | display set | match evpn

# After upgrade, confirm the fixed release is running
show system software