CVE-2025-52946
BaseFortify
Publication date: 2025-07-11
Last updated on: 2025-07-15
Assigner: Juniper Networks, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| juniper | junos_os_evolved | * |
| juniper | junos_os | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-416 | The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Use After Free issue in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. An attacker can send a BGP update containing a specifically malformed AS PATH attribute, which causes the rpd process to crash. If traceoptions for BGP are enabled and a BGP session is established, continuous receipt of such malformed updates will cause a sustained Denial of Service (DoS) condition by repeatedly crashing and restarting the rpd process.
How can this vulnerability impact me? :
The impact of this vulnerability is a Denial of Service (DoS) condition on affected Junos OS and Junos OS Evolved systems with BGP traceoptions enabled. The rpd process will crash and restart upon receiving a malformed AS PATH in a BGP update, potentially disrupting network routing and causing service outages until the issue is resolved or the malformed updates stop.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, disable BGP traceoptions on affected Junos OS or Junos OS Evolved systems until a fixed version is applied, as the issue only affects systems with BGP traceoptions enabled. Additionally, upgrade to a fixed version of Junos OS or Junos OS Evolved as listed in the CVE description to prevent the rpd process from crashing due to malformed AS PATH attributes.