CVE-2025-52961: Juniper Junos OS Evolved DoS Vulnerability

CVE-2025-52961 Overview

CVE-2025-52961 is an uncontrolled resource consumption vulnerability [CWE-400] in the Connectivity Fault Management (CFM) daemon (cfmd) and CFM Manager (cfmman) of Juniper Networks Junos OS Evolved. The flaw affects PTX10001-36MR, PTX10002-36QDD, PTX10004, PTX10008, and PTX10016 routing platforms. An unauthenticated attacker on an adjacent network segment can send specific valid traffic that drives cfmd CPU usage to 100% and triggers a memory leak in cfmman. Sustained exploitation causes the Flexible PIC Concentrator (FPC) to crash and restart, producing a denial-of-service condition on core routing infrastructure.

Critical Impact
Continued receipt of the triggering packets sustains the DoS condition, forcing FPC restarts on affected PTX-series routers and disrupting transit traffic.

Affected Products

Juniper Junos OS Evolved on PTX10001-36MR, PTX10002-36QDD, PTX10004, PTX10008, PTX10016 from 23.2R1-EVO before 23.2R2-S4-EVO
Junos OS Evolved from 23.4 before 23.4R2-S4-EVO and from 24.2 before 24.2R2-EVO
Junos OS Evolved from 24.4 before 24.4R1-S2-EVO and 24.4R2-EVO

Discovery Timeline

2025-10-09 - CVE-2025-52961 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-52961

Vulnerability Analysis

The vulnerability resides in how the CFM subsystem processes valid CFM protocol traffic. CFM implements IEEE 802.1ag-style Ethernet OAM functions that monitor point-to-point and multipoint connectivity across service provider networks. When cfmd parses specific valid CFM frames arriving from an adjacent device, it consumes CPU cycles without bound and drives utilization to 100%. Simultaneously, cfmman allocates memory that it never releases, producing a persistent leak in the FPC control plane.

As cfmman resident set size grows into the gigabyte range, the FPC exhausts available memory and crashes. Junos OS Evolved restarts the FPC, but continued arrival of the trigger traffic reproduces the condition. The result is a repeating outage on the affected line card.

Root Cause

The root cause is missing rate or resource limits when the CFM daemon processes conformant protocol frames. Because the packets are valid, upstream filters do not drop them, and the daemon commits CPU and memory resources on every message without an enforced ceiling. Authentication is not required because CFM operates at Layer 2 between adjacent nodes.

Attack Vector

An attacker requires only adjacent network access, typically a Layer 2 adjacency to a CFM-enabled interface on an affected PTX router. No credentials or user interaction are needed. The attacker transmits crafted but standards-conformant CFM traffic to the target interface. Sustained transmission maintains the CPU spike, memory leak, and repeating FPC crash cycle. Verified code examples are not available; refer to the Juniper Support Advisory JSA103144 for vendor technical details.

Detection Methods for CVE-2025-52961

Indicators of Compromise

Sustained cfmd CPU utilization at or near 100% on one or more FPCs
Growth of cfmman resident set size (RSS) into the gigabyte range over time
Repeated FPC crash and restart events correlated with CFM traffic on adjacent links
Loss of CFM continuity check messages and transit forwarding interruptions during FPC restarts

Detection Strategies

Run show system processes node fpc<num> detail | match cfmman and evaluate the RSS column for abnormal growth
Baseline normal cfmd and cfmman resource usage per FPC and alert on deviations exceeding baseline thresholds
Correlate FPC restart syslog events with inbound CFM frame rates on adjacent interfaces

Monitoring Recommendations

Ingest Junos OS Evolved syslog and process telemetry into a centralized analytics platform for trending on cfmman RSS and cfmd CPU
Monitor FPC uptime and crash counters across all PTX10001-36MR, PTX10002-36QDD, PTX10004, PTX10008, and PTX10016 chassis
Alert on CFM protocol volume spikes on interfaces facing untrusted or partner networks

How to Mitigate CVE-2025-52961

Immediate Actions Required

Inventory all PTX-series devices running Junos OS Evolved and identify versions in the affected ranges
Schedule upgrades to a fixed release: 23.2R2-S4-EVO, 23.4R2-S4-EVO, 24.2R2-EVO, 24.4R1-S2-EVO, 24.4R2-EVO, or later
If cfmman RSS is already growing into gigabytes, plan a device restart to temporarily reclaim memory
Restrict CFM-enabled interfaces to trusted adjacencies where operationally feasible

Patch Information

Juniper has released fixed builds of Junos OS Evolved. Upgrade to 23.2R2-S4-EVO, 23.4R2-S4-EVO, 24.2R2-EVO, 24.4R1-S2-EVO, or 24.4R2-EVO. Systems running versions earlier than 23.2R1-EVO are not affected. Full remediation guidance is available in Juniper Support Advisory JSA103144.

Workarounds

Limit CFM configuration to interfaces connected to trusted peers only, per Juniper CFM Configuration documentation
Restart the affected FPC or device to clear leaked cfmman memory as a temporary measure
Apply access control at the network edge to prevent untrusted Layer 2 adjacencies from delivering CFM frames

bash

# Command to evaluate cfmman memory usage on a specific FPC
show system processes node fpc0 detail | match cfmman