CVE-2025-52964: Juniper Junos RPD DoS Vulnerability

CVE-2025-52964 Overview

CVE-2025-52964 is a reachable assertion vulnerability [CWE-617] in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. An unauthenticated, network-adjacent attacker can trigger a Denial of Service (DoS) by sending a specific BGP UPDATE packet from an established BGP peer. The rpd process crashes and restarts upon receipt. Continuous delivery of the malformed UPDATE produces a sustained outage of routing functionality. Exploitation requires that BGP multipath with the pause-computation-during-churn option be configured on the target device.

Critical Impact
A single crafted BGP UPDATE from an established peer repeatedly crashes rpd, disrupting routing convergence and tenant traffic on affected Juniper routers and switches.

Affected Products

Juniper Junos OS: all versions before 21.4R3-S7; 22.3 before 22.3R3-S3; 22.4 before 22.4R3-S5; 23.2 before 23.2R2; 23.4 before 23.4R2
Juniper Junos OS Evolved: all versions before 21.4R3-S7-EVO; 22.3 before 22.3R3-S3-EVO; 22.4 before 22.4R3-S5-EVO; 23.2 before 23.2R2-EVO; 23.4 before 23.4R2-EVO
Devices configured with BGP multipath and pause-computation-during-churn

Discovery Timeline

2025-07-11 - CVE-2025-52964 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-52964

Vulnerability Analysis

The flaw resides in the Routing Protocol Daemon (rpd), the user-space process on Junos that implements BGP, OSPF, IS-IS, and other routing protocols. When rpd parses a specific BGP UPDATE message under multipath processing with pause-computation-during-churn enabled, an internal assertion fails. The assertion aborts rpd, which the system then restarts. Repeated receipt of the trigger packet keeps rpd in a crash-restart loop, suspending BGP sessions, draining route tables, and interrupting forwarding decisions across the control plane.

Root Cause

The defect is a reachable assertion [CWE-617] in the multipath path-selection code path invoked when churn pausing is active. Input validation on the BGP UPDATE does not reject the condition that violates the assumed invariant, allowing an attacker-controlled packet to reach the assert() check and terminate the process.

Attack Vector

Exploitation requires an established BGP session with the victim. An attacker controlling a configured BGP peer, or any upstream router capable of injecting UPDATE messages into an existing session, can send the crafted paths. No authentication beyond the already-negotiated BGP peering is required, and no user interaction is needed. The attack vector is adjacent-network because BGP sessions are generally established with directly peered neighbors.

No public proof-of-concept has been released. Juniper's advisory describes the trigger as a specific BGP UPDATE packet carrying paths that drive the multipath computation into the vulnerable code branch. Refer to the Juniper Security Advisory JSA100080 for packet-level details available to registered customers.

Detection Methods for CVE-2025-52964

Indicators of Compromise

Repeated rpd core files on the device, typically found under /var/crash/ or /var/tmp/ on Junos OS
Syslog entries referencing rpd assertion failures, RPD_TASK_REINIT, or rpd restarted messages in close succession
BGP session flaps on multiple peers coinciding with the rpd restart timestamps
Loss of installed routes and FIB churn following receipt of a specific peer's UPDATE message

Detection Strategies

Alert on more than one rpd crash within a short interval using SNMP traps or streaming telemetry from the device
Monitor BGP neighbor state transitions and correlate Idle or Active states with rpd process restarts
Review recent BGP UPDATE traffic from each peer when a crash occurs, focusing on sessions carrying multipath-eligible NLRI

Monitoring Recommendations

Forward Junos syslog and rpd trace data to a centralized log platform and build detections for assertion strings and task reinitialization events
Capture BGP MRT or pcap samples at peering edges so analysts can replay suspect UPDATE messages after a crash
Track configuration state for pause-computation-during-churn across the fleet to identify exposed devices

How to Mitigate CVE-2025-52964

Immediate Actions Required

Inventory all Junos OS and Junos OS Evolved devices running affected versions and determine which have BGP multipath with pause-computation-during-churn configured
Schedule upgrades to a fixed release on any device that matches both conditions, prioritizing internet-facing and route-reflector roles
Restrict BGP peering to trusted, authenticated neighbors and verify TCP-AO or MD5 authentication is enabled on every session

Patch Information

Juniper has released fixed software in Junos OS 21.4R3-S7, 22.3R3-S3, 22.4R3-S5, 23.2R2, 23.4R2, and later, with matching -EVO builds for Junos OS Evolved. Full fix matrix and download links are available in Juniper Security Advisory JSA100080.

Workarounds

Remove the pause-computation-during-churn statement from the BGP multipath configuration until the device is upgraded
Limit the set of peers that can advertise multipath-eligible NLRI by applying import policies that filter unexpected path attributes
Apply BGP infrastructure ACLs and control-plane policing to limit exposure of the routing control plane to only approved peers

bash

# Remove the vulnerable configuration option on Junos
configure
delete protocols bgp group <group-name> multipath pause-computation-during-churn
commit comment "Mitigate CVE-2025-52964 pending upgrade"