CVE-2025-52953: Juniper Junos BGP DoS Vulnerability

CVE-2025-52953 Overview

CVE-2025-52953 is an Expected Behavior Violation vulnerability [CWE-440] in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. An unauthenticated adjacent attacker can send a valid Border Gateway Protocol (BGP) UPDATE packet that causes the receiving router to reset the BGP session. Continuous receipt of the crafted packet sustains a Denial of Service (DoS) condition against the routing plane. The flaw affects both internal BGP (iBGP) and external BGP (eBGP) sessions across IPv4 and IPv6 address families. Juniper published advisory JSA100059 alongside fixed releases across supported Junos OS and Junos OS Evolved train branches.

Critical Impact
A single valid BGP UPDATE from an adjacent peer can tear down a BGP session, and sustained delivery keeps the session flapping and the routing plane unstable.

Affected Products

Juniper Junos OS: all versions before 21.2R3-S9, and multiple release trains through 24.4 before 24.4R1-S3 / 24.4R2
Juniper Junos OS Evolved: all versions before 22.2R3-S7-EVO through 24.4 before 24.4R1-S3-EVO / 24.4R2-EVO
Deployments running iBGP or eBGP over IPv4 or IPv6

Discovery Timeline

2025-07-11 - CVE-2025-52953 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-52953

Vulnerability Analysis

The vulnerability resides in rpd, the Junos routing protocol daemon that manages BGP state, path selection, and route installation. Processing of a specific, protocol-valid BGP UPDATE message deviates from expected behavior and triggers a reset of the affected BGP peering session. Because the offending packet is standards-compliant rather than malformed, upstream validation and standard peer sanity checks do not filter it. The impact is confined to availability: no confidentiality or integrity loss occurs, but routing convergence, traffic engineering, and any services dependent on BGP-learned reachability are disrupted while the session cycles.

Root Cause

Juniper classifies the defect as an Expected Behavior Violation [CWE-440]. The rpd implementation handles a legitimate combination of BGP UPDATE attributes in a way that does not match the RFC-defined outcome, causing session teardown instead of normal route processing or a scoped error handled per RFC 7606 (revised error handling for BGP UPDATE messages).

Attack Vector

Exploitation requires adjacent network access, meaning the attacker must control or compromise a device that already has an established BGP peering relationship with the target. No authentication credentials or user interaction are required beyond the standard BGP session establishment. Once peered, the attacker transmits the triggering UPDATE. Continuous transmission maintains a persistent DoS condition, as each reconnection is followed by another reset. Because both eBGP and iBGP are affected, the risk extends to compromised route reflectors, transit peers, internet exchange participants, and lab or partner interconnects.

See the Juniper Support Portal Advisory JSA100059 for the authoritative technical description.

Detection Methods for CVE-2025-52953

Indicators of Compromise

Unexpected BGP session state transitions logged by rpd, particularly repeated moves from Established to Idle or Active with the same neighbor
RPD_BGP_NEIGHBOR_STATE_CHANGED syslog events correlated with received UPDATE messages from a single peer
Sudden route churn, withdrawal storms, or FIB reprogramming activity tied to one adjacency

Detection Strategies

Enable BGP trace options for update and state events on peers running unpatched code to capture the offending UPDATE for triage
Correlate rpd syslog messages with NetFlow, sFlow, or streaming telemetry to identify which peer initiated the session reset
Alert on abnormal BGP session uptime resets in network monitoring systems such as those consuming JTI/gNMI telemetry

Monitoring Recommendations

Forward Junos syslog and streaming telemetry to a centralized analytics platform and build detections for repeated NOTIFICATION sent/received events from the same neighbor
Baseline BGP session uptime per peer and alert on deviations that indicate flapping
Monitor peer prefix counts and hold-timer expirations to distinguish network events from an attacker-driven reset loop

How to Mitigate CVE-2025-52953

Immediate Actions Required

Identify all Junos OS and Junos OS Evolved devices running affected releases and prioritize those with external or third-party BGP peers
Upgrade to a fixed release listed in JSA100059, such as 21.2R3-S9, 21.4R3-S11, 22.2R3-S7, 22.4R3-S7, 23.2R2-S4, 23.4R2-S4, 24.2R2, or 24.4R1-S3 / 24.4R2 (and the corresponding -EVO builds)
Audit BGP peer inventories to confirm that all sessions authenticate with TCP-AO or MD5 and that peer IP addresses are restricted via firewall filters

Patch Information

Juniper has released fixed versions for each supported Junos OS and Junos OS Evolved train. Refer to the Juniper Support Portal Advisory JSA100059 for the definitive list of fixed builds and download locations. Apply the patch during a maintenance window because rpd upgrades affect the control plane.

Workarounds

Apply strict inbound BGP policies that reject or normalize unusual attribute combinations, reducing exposure from peers that could relay a crafted UPDATE
Restrict BGP peering to trusted neighbors using loopback-based sessions, infrastructure ACLs, and TCP authentication, per the Juniper BGP Security Configuration Guide
Where feasible, enable BGP error handling features consistent with RFC 7606 (treat-as-withdraw) to contain malformed or unexpected attribute processing
Segment route reflectors and confederation members so that a single compromised peer cannot flap sessions network-wide

bash

# Example: restrict BGP peering to a defined prefix list on Junos
set policy-options prefix-list BGP-PEERS 203.0.113.10/32
set policy-options prefix-list BGP-PEERS 203.0.113.11/32
set firewall family inet filter PROTECT-RE term ALLOW-BGP from source-prefix-list BGP-PEERS
set firewall family inet filter PROTECT-RE term ALLOW-BGP from protocol tcp
set firewall family inet filter PROTECT-RE term ALLOW-BGP from destination-port bgp
set firewall family inet filter PROTECT-RE term ALLOW-BGP then accept
set firewall family inet filter PROTECT-RE term DENY-BGP from protocol tcp destination-port bgp
set firewall family inet filter PROTECT-RE term DENY-BGP then discard
set interfaces lo0 unit 0 family inet filter input PROTECT-RE