CVE-2025-52955: Juniper Junos RPD Memory Corruption DOS

CVE-2025-52955 Overview

CVE-2025-52955 is an Incorrect Calculation of Buffer Size vulnerability [CWE-131] in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. An adjacent, unauthenticated attacker can trigger memory corruption that crashes rpd. When a logical interface bound to a routing instance flaps continuously, specific updates are sent to the jflow/sflow modules and cause the memory corruption. Sustained delivery of these updates produces a persistent Denial of Service on the affected router.

Critical Impact
Continued receipt of triggering updates keeps rpd in a crash-restart loop, disrupting routing on affected Juniper devices.

Affected Products

Juniper Junos OS: all versions before 21.2R3-S9, all 21.4, all 22.2, 22.4 before 22.4R3-S7, 23.2 before 23.2R2-S3, 23.4 before 23.4R2-S4, 24.2 before 24.2R2
Juniper Junos OS Evolved: all 21.2-EVO, all 21.4-EVO, all 22.2-EVO, 22.4 before 22.4R3-S7-EVO, 23.2 before 23.2R2-S3-EVO, 23.4 before 23.4R2-S4-EVO, 24.2 before 24.2R2-EVO
Devices running rpd with jflow or sflow sampling enabled on flapping logical interfaces

Discovery Timeline

2025-07-11 - CVE-2025-52955 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-52955

Vulnerability Analysis

The defect resides in the routing protocol daemon (rpd), a core process that manages routing state on Junos OS and Junos OS Evolved. When a logical interface associated with a routing instance flaps repeatedly, rpd emits update messages to the flow accounting modules (jflow and sflow). The buffer size for these updates is calculated incorrectly, producing memory corruption inside rpd. The daemon crashes and is restarted by the Junos process manager. Because the trigger is external interface state, an attacker on an adjacent network can drive continuous flapping and keep rpd in a restart loop, resulting in a sustained routing outage.

Root Cause

The root cause is an Incorrect Calculation of Buffer Size [CWE-131] in the code path that constructs update messages for jflow/sflow when a routing-instance logical interface transitions state. The allocated buffer does not match the size required by the update payload, corrupting adjacent memory in the rpd heap.

Attack Vector

Exploitation requires network adjacency to the target device and no authentication or user interaction. An attacker that can influence the up/down state of a logical interface tied to a routing instance, for example by toggling a directly connected link or by causing protocol churn on an adjacent segment, can drive continuous flaps. Each flap emits the malformed-size update to the flow accounting modules, corrupting rpd memory and forcing a crash. Repeated triggering sustains the Denial of Service.

No verified public exploit or proof-of-concept code is available. The vulnerability is described in prose based on the vendor advisory; see the Juniper Security Advisory JSA100062 for full technical detail.

Detection Methods for CVE-2025-52955

Indicators of Compromise

Repeated rpd core files or process restart events in /var/log/messages and /var/log/chassisd
Frequent up/down transitions on logical interfaces bound to a routing instance with jflow or sflow sampling enabled
Sudden loss of routing adjacencies (BGP, OSPF, IS-IS) correlated with rpd restart timestamps

Detection Strategies

Alert on any rpd crash or core file generation using Junos syslog messages such as RPD_TASK_REINIT and rpd[<pid>]: terminated
Correlate interface flap counters (show interfaces extensive) against rpd restart events to identify the trigger pattern described in JSA100062
Ingest device syslog into a centralized analytics platform and build a rule for high-frequency logical-interface flaps followed by routing protocol resets

Monitoring Recommendations

Baseline rpd uptime with show system processes extensive | match rpd and alert on unexpected restarts
Monitor jflow/sflow configuration state and route-instance interface stability through NETCONF or streaming telemetry
Track BGP, OSPF, and IS-IS adjacency flaps on affected platforms and treat clusters of resets as candidate DoS events

How to Mitigate CVE-2025-52955

Immediate Actions Required

Inventory all Junos OS and Junos OS Evolved devices and compare running versions against the fixed releases listed in JSA100062
Upgrade affected devices to 21.2R3-S9, 22.4R3-S7, 23.2R2-S3, 23.4R2-S4, 24.2R2, or later, using the corresponding -EVO builds for Junos OS Evolved
Restrict which adjacent systems can influence logical-interface state on routing-instance interfaces, especially at customer or partner demarcation points

Patch Information

Juniper Networks addresses CVE-2025-52955 in Junos OS releases 21.2R3-S9, 22.4R3-S7, 23.2R2-S3, 23.4R2-S4, 24.2R2, and all subsequent releases. Equivalent fixes are available for Junos OS Evolved in 22.4R3-S7-EVO, 23.2R2-S3-EVO, 23.4R2-S4-EVO, 24.2R2-EVO, and later. Refer to the Juniper Security Advisory JSA100062 for the authoritative fixed-version list.

Workarounds

Disable jflow and sflow sampling on logical interfaces associated with routing instances until patches are applied, if operationally acceptable
Apply interface damping or hold-time configuration to reduce the rate of logical-interface flaps that can drive the trigger condition
Enforce Layer 2 controls that prevent adjacent devices from repeatedly cycling link state on interfaces bound to routing instances

bash

# Verify running Junos version and plan upgrade
show version | match "Junos:"

# Identify logical interfaces tied to routing instances with flow sampling
show configuration routing-instances | display set | match interface
show configuration forwarding-options sampling | display set

# Optional workaround: remove sFlow/jFlow sampling on exposed interfaces
delete forwarding-options sampling instance <name> family inet output flow-server
delete protocols sflow interfaces <ifname>
commit confirmed 5