CVE-2025-59962: Juniper Junos BGP Sharding DoS Vulnerability

CVE-2025-59962 Overview

CVE-2025-59962 is an Access of Uninitialized Pointer vulnerability [CWE-824] in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. The flaw affects devices with Border Gateway Protocol (BGP) sharding configured. An attacker who triggers indirect next-hop updates can cause rpd to crash and restart, resulting in a Denial of Service (DoS) condition. Repeated Interior Gateway Protocol (IGP) route churn forcing continuous BGP route re-resolution increases the probability of the crash, extending the outage window. Juniper disclosed the issue in security advisory JSA103151 and classified it as medium severity.

Critical Impact
Successful exploitation crashes the routing protocol daemon, disrupting BGP and IGP route processing on affected Juniper routers and causing network-layer service interruption.

Affected Products

Juniper Junos OS: all versions before 21.4R3-S6; 22.1 before 22.1R3-S6; 22.2 before 22.2R3-S3; 22.3 before 22.3R3-S3; 22.4 before 22.4R3; 23.2 before 23.2R2
Juniper Junos OS Evolved: all versions before 22.3R3-S3-EVO; 22.4 before 22.4R3-EVO; 23.2 before 23.2R2-EVO
Versions before Junos OS 21.3R1 and Junos OS Evolved 21.3R1-EVO are unaffected

Discovery Timeline

2025-10-09 - CVE-2025-59962 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59962

Vulnerability Analysis

The defect resides in the rpd process that handles routing protocol state on Junos OS and Junos OS Evolved. When BGP sharding is enabled, rpd distributes route processing across worker shards for scalability. During route resolution of an indirect next-hop, such as an IGP route change over which a BGP route is resolved, the code path dereferences a pointer that has not been fully initialized. The resulting crash terminates rpd and triggers a restart. During the restart interval, the device cannot process routing updates, drops BGP sessions, and reconverges once the daemon returns. Because the trigger depends on timing between route resolution events, exploitation requires repeated attempts rather than a single deterministic request.

Root Cause

The root cause is classified as CWE-824 Access of Uninitialized Pointer. Code paths in the sharded route-resolution logic reference a pointer whose initialization is not guaranteed under the specific sequence of indirect next-hop updates. When the uninitialized memory is dereferenced, rpd faults and the daemon is restarted by the Junos process manager.

Attack Vector

The attack vector is Adjacent Network. An attacker must be able to influence IGP routing state visible to the target router, typically from within the same routing domain or a connected network segment. Causing continuous IGP route churn forces repeated BGP route re-resolution, which raises the probability of hitting the uninitialized pointer window. No authentication or user interaction is required, but the timing dependency is outside the attacker's direct control. No public proof-of-concept exploit, Exploit-DB entry, or CISA Known Exploited Vulnerabilities (KEV) listing exists for this issue.

No verified exploitation code has been published. See the Juniper Security Advisory JSA103151 for vendor technical details.

Detection Methods for CVE-2025-59962

Indicators of Compromise

Unexpected rpd process restarts recorded in Junos system logs, often correlated with RPD_ facility crash messages and core files written to /var/crash/ or /var/tmp/.
BGP session flaps and transient loss of routes immediately following IGP topology changes on devices with BGP sharding enabled.
Repeated routing reconvergence events on affected Junos OS and Junos OS Evolved versions that have not yet been patched.

Detection Strategies

Monitor show system core-dumps output and syslog streams for rpd core files and signal-based termination entries.
Correlate IGP (OSPF or IS-IS) adjacency churn with BGP session resets to identify routing instability patterns consistent with this defect.
Inventory Junos OS and Junos OS Evolved devices and flag any configuration containing set routing-options rib-sharding or BGP sharding knobs on vulnerable releases.

Monitoring Recommendations

Forward Junos syslog and SNMP trap data for rpd restart events to a centralized logging platform for alerting.
Track BGP peer uptime metrics and alert on simultaneous session resets across multiple peers.
Baseline normal IGP route churn and generate alerts when churn rates exceed expected thresholds for sustained periods.

How to Mitigate CVE-2025-59962

Immediate Actions Required

Identify all Junos OS and Junos OS Evolved devices running affected releases and determine whether BGP sharding is configured.
Schedule upgrades to a fixed release during a maintenance window, prioritizing devices that peer with untrusted or external networks.
Restrict IGP participation to authenticated and trusted neighbors to limit adversary influence over route churn.

Patch Information

Juniper has released fixed software versions. Upgrade Junos OS to 21.4R3-S6, 22.1R3-S6, 22.2R3-S3, 22.3R3-S3, 22.4R3, 23.2R2, or later. Upgrade Junos OS Evolved to 22.3R3-S3-EVO, 22.4R3-EVO, 23.2R2-EVO, or later. Full remediation details are available in Juniper Security Advisory JSA103151.

Workarounds

Where feasible, disable BGP sharding on affected devices until the fixed release is deployed, since the defect only manifests with sharding enabled.
Enforce IGP authentication (for example, OSPF or IS-IS MD5 or HMAC) and strict neighbor filtering to reduce the attack surface for induced route churn.
Apply BGP route damping and inbound policy filtering to limit the propagation of unstable routes that would trigger repeated re-resolution.

bash

# Verify installed Junos release and inspect BGP sharding configuration
show version
show configuration routing-options | display set | match shard
show system core-dumps
show system processes extensive | match rpd