CVE-2025-59958: Juniper Junos OS Evolved DoS Vulnerability

CVE-2025-59958 Overview

CVE-2025-59958 is an Improper Check for Unusual or Exceptional Conditions vulnerability [CWE-754] in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS Evolved on PTX Series routers. When an output firewall filter contains one or more terms with a reject action, matching packets are erroneously punted to the Routing Engine (RE) instead of being discarded at the PFE. This behavior consumes limited RE resources and can leak confidential device information through RE-generated responses to the traffic source. An unauthenticated, network-based attacker can trigger the condition by sending packets that match the filter terms.

Critical Impact
Remote unauthenticated attackers can exhaust Routing Engine resources and extract confidential information from affected PTX Series devices through crafted network traffic.

Affected Products

Juniper Junos OS Evolved on PTX Series: all versions before 22.4R3-EVO
Juniper Junos OS Evolved on PTX Series: 23.2 versions before 23.2R2-EVO
PTX1000, PTX10001-36MR, PTX10002, PTX10003, PTX10004, PTX10008, PTX10016, PTX3000, and PTX5000 hardware platforms

Discovery Timeline

2025-10-09 - CVE-2025-59958 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59958

Vulnerability Analysis

The defect resides in how the Packet Forwarding Engine handles the reject action within output firewall filters. In correct behavior, the PFE drops packets matching a reject term at line rate and optionally returns an ICMP unreachable message. In vulnerable releases, the PFE instead forwards these packets to the Routing Engine for further processing. Each punted packet consumes CPU and memory resources on the RE, which is not designed for high-volume data-plane traffic. Sustained traffic matching the filter can degrade control-plane responsiveness on the router. RE responses generated for these punted packets can also disclose confidential information about the affected device to the sender.

Root Cause

The root cause is missing validation of the exceptional path for reject terms in output firewall filters. The PFE fails to enforce the terminal drop semantics of the action and defaults to a slow-path handling routine that hands the packet to the RE.

Attack Vector

Exploitation requires no authentication and no user interaction. An attacker sends packets across the network that traverse an affected PTX device and match a reject term on an output firewall filter applied to a WAN or revenue interface. The scope is limited: filters bound to the mgmt interface, the lo0 interface, or any input filters are not affected. The vulnerability description is available in the Juniper Security Advisory JSA103147.

Detection Methods for CVE-2025-59958

Indicators of Compromise

Elevated Routing Engine CPU or memory utilization on PTX Series devices without a corresponding change in control-plane workload.
Unusual volumes of ICMP or protocol unreachable responses egressing WAN interfaces toward external sources.
Firewall filter counters on output filters with reject terms showing sustained hit rates.

Detection Strategies

Audit Junos OS Evolved configurations for output firewall filters containing then reject terms applied to WAN or revenue interfaces.
Correlate RE resource exhaustion events with traffic patterns matching filter terms using flow telemetry.
Compare running software versions on PTX devices against the fixed releases 22.4R3-EVO and 23.2R2-EVO.

Monitoring Recommendations

Enable SNMP or streaming telemetry for RE CPU, memory, and process utilization on PTX Series routers.
Log and alert on abnormal rates of firewall filter reject counter increments.
Monitor egress ICMP unreachable traffic volumes for anomalies indicating punted-packet activity.

How to Mitigate CVE-2025-59958

Immediate Actions Required

Identify all PTX Series devices running Junos OS Evolved versions earlier than 22.4R3-EVO or in the 23.2 branch before 23.2R2-EVO.
Upgrade affected devices to a fixed release as documented in Juniper Security Advisory JSA103147.
Review all output firewall filters on WAN and revenue interfaces for reject terms and evaluate whether they can be replaced with discard until patching is complete.

Patch Information

Juniper Networks has published fixed versions in Junos OS Evolved 22.4R3-EVO and 23.2R2-EVO. Consult the Juniper Security Advisory JSA103147 for the complete list of resolved releases and upgrade guidance for each PTX platform.

Workarounds

Replace then reject actions with then discard in output firewall filters on WAN and revenue interfaces to prevent packets from being punted to the RE.
Restrict reject semantics to input firewall filters, which are not affected by this vulnerability.
Apply control-plane protection policers to limit the rate of traffic reaching the RE from data-plane interfaces.

bash

# Configuration example: replace reject with discard on affected output filters
set firewall family inet filter WAN-EGRESS term BLOCK-BAD then discard
delete firewall family inet filter WAN-EGRESS term BLOCK-BAD then reject
commit