CVE-2025-52982

Juniper Junos OS MX Series with MS-MPC SIP ALG is affected. When two or more SIP-processing service sets run, an improper resource shutdown can cause the MS-MPC to crash and restart, enabling unauthenticated network-based DoS. Affected versions: all before 21.2R3-S9; 21.4 from 21.4R1; 22.2 before...

CVE-2026-33790

Threat summary (CVE-2026-33790): Juniper Junos OS on SRX Series is affected by an improper check in the flowd component during NAT64 translation. Receipt of a specific, malformed ICMPv6 packet to the device may crash and restart the srxpfe process, leading to a sustained DoS. Affected software in...

CVE-2025-52964

CVE-2025-52964 is a Reachable Assertion vulnerability in Juniper Networks Junos OS and Junos OS Evolved rpd. An unauthenticated, network-based attacker can trigger a crash by sending a specific BGP UPDATE packet when BGP multipath pause-computation-during-churn is configured, leading to a sustain...

CVE-2025-52981

CVE-2025-52981 affects Juniper JUNOS OS flowd on SRX1600/SRX2300/SRX4000/SRX5000 (with SPC3). A sequence of specific PIM multicast packets can cause an unauthenticated network-based attacker to crash flowd and restart, resulting in DoS. Vulnerable versions include all before 21.2R3-S9, 21.4 befor...

CVE-2026-21914

CVE-2026-21914 describes an Improper Locking vulnerability in the GTP plugin of Juniper Networks Junos OS on SRX Series. A specially crafted GTP Modify Bearer Request can cause a lock to be acquired and never released, preventing other threads from acquiring it, triggering a watchdog timeout and ...

CVE-2026-57022

CVE-2026-57022 affects Junos OS on MX Series with SPC3, SRX Series (including vSRX). The vulnerability stems from an improper check for unusual or exceptional conditions in the Packet Forwarding Engine (PFE). A unauthenticated, network-based attacker can trigger a PFE crash by a TCP connection to...

CVE-2025-52951

CVE-2025-52951 describes a Protection Mechanism Failure in Juniper Networks Junos OS where kernel filter processing mishandles the payload-protocol match, causing firewall terms to effectively accept all traffic destined for the control plane IPv6 traffic. Affected Junos OS versions include all p...

CVE-2025-52983

CVE-2025-52983 describes a UI discrepancy in Junos OS on VM Host systems (VM Host Routing Engines) that allows a network-based, unauthenticated attacker to access the device. On REs, even after removing the public key for root login, users with the corresponding private key can still log in as ro...

CVE-2025-59960

CVE-2025-59960 affects Juniper Networks Junos OS and Junos OS Evolved. The vulnerability arises in the DHCP service (jdhcpd) where the default DHCP relay behavior allows Option 82 information from a client in one subnet to reach the DHCP server unmodified, enabling a DHCP client to exhaust addres...

CVE-2025-60003

CVE-2025-60003 affects Juniper Networks Junos OS and Junos OS Evolved. A Buffer Over-read in the routing protocol daemon (rpd) can be triggered by a BGP update containing specific optional transitive attributes when peers are not 4-byte-AS capable, causing the rpd process to crash and the device ...

CVE-2026-21918

CVE-2026-21918 describes a Double Free vulnerability in the flow processing daemon (flowd) of Juniper Networks Junos OS on SRX and MX Series. The issue allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS) by sending a specific sequence of TCP packets during session...

CVE-2025-59957

CVE-2025-59957 affects Juniper Networks Junos OS on EX4600 Series and QFX5000 Series switches. Affected versions: all prior to 21.4R3 and 22.2 prior to 22.2R3-S3. The vulnerability is a runtime/Origin Validation Error in an insufficient protected file , allowing an unauthenticated attacker with p...

CVE-2026-57020

CVE-2026-57020 affects Junos OS on Juniper’s QFX10000 Series. The issue arises in the packet forwarding engine (pfe) where an unauthenticated, adjacent attacker can trigger a DoS by sending IPv6 multicast traffic in an EVPN-VxLAN setup; if these packets reach the spine’s non-IRB interface, they f...

CVE-2025-52947

CVE-2025-52947 affects Juniper Networks Junos OS on ACX1000/1100/2000/2100/2200/4000/5048/5096, older than 21.2R3-S9. Root cause: improper handling of exceptional conditions in route processing when the L2 circuit’s primary path port IGP goes down while hot-standby is configured, causing FEB0 to ...

CVE-2025-52986

Summary: CVE-2025-52986 is a memory leak in Juniper Networks Junos OS and Junos OS Evolved’s routing protocol daemon (rpd) triggered when RIB sharding is enabled and a user runs certain routing-related show commands. The leak can exhaust memory, causing rpd to crash and restart, impacting device ...

CVE-2025-59980

Summary of CVE-2025-59980 : Juniper Networks Junos OS FTP server contains an authentication bypass. When the FTP server is enabled and a user named “ftp” or “anonymous” exists, an unauthenticated attacker can log in without a password and gain read/write access to the user’s home directory. Affec...

CVE-2025-52948

Summary: CVE-2025-52948 describes an Improper Handling of Exceptional Conditions vulnerability in the Berkeley Packet Filter (BPF) processing in Juniper Networks Junos OS that can cause the FPC and system to crash and restart under rare traffic patterns, especially when packet capture is enabled....

CVE-2025-52946

CVE-2025-52946 is a Use After Free in Juniper Junos OS and Junos OS Evolved rpd triggered by a BGP update containing a specifically malformed AS PATH, causing the rpd process to crash and restart and resulting in DoS when traceoptions are enabled. Affected: Junos OS and Junos OS Evolved across mu...

CVE-2025-52949

CVE-2025-52949 describes an Improper Handling of Length Parameter Inconsistency in Juniper’s rpd component of Junos OS and Junos OS Evolved. A logically adjacent BGP peer can send a specifically malformed BGP update in EVPN environments, causing rpd to crash and restart, leading to a Denial of Se...

CVE-2025-52952

CVE-2025-52952 affects Juniper Networks Junos OS on MX Series with MPC-BUILTIN, MPC1–MPC9. The issue is an out-of-bounds write in the CFM daemon that allows an unauthenticated adjacent attacker to send a malformed packet, triggering an FPC crash and device restart and causing a Denial of Service ...

CVE-2025-52984

CVE-2025-52984 – Juniper Junos OS / Junos OS Evolved Root cause: a NULL pointer dereference in the routing protocol daemon (rpd) when a static route points to a reject next hop and a gNMI query is processed for that route, causing rpd to crash and restart and thus impacting device availability. A...

CVE-2026-0203

CVE-2026-0203 affecting Juniper Networks Junos OS —An Improper Handling of Exceptional Conditions vulnerability in packet processing can be exploited by an unauthenticated, network-adjacent attacker sending a specifically malformed ICMP (IPv4) packet. This causes the Flexible Packet Processor (FP...

CVE-2026-21903

CVE-2026-21903 is a stack-based buffer overflow in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS. A network-based attacker with low privileges can trigger a Denial-of-Service by subscribing to telemetry sensors at scale, which causes all FPC connections to drop, an FPC crash, an...

CVE-2026-21912

CVE-2026-21912 is a TOCTOU race in Juniper Junos OS on MX10k Series affecting LC480/LC2101 line cards. Repeatedly running the CLI command “show system firmware” can cause a line card to crash and restart, with chassisd potentially crashing and generating a core dump after the line card failure. A...

CVE-2026-33782

CVE-2026-33782 affects Junos OS on MX Series running DHCP daemon (jdhcpd). In specific DHCPv6 scenarios (DHCPv6 over PPPoE or VLAN with Active lease query or Bulk lease query), every subscriber logout leaks memory, leading to memory exhaustion, jdhcpd crash, and a full service impact until recove...

CVE-2025-60007

The CVE-2025-60007 entry describes a NULL pointer dereference in Juniper Networks Junos OS chassisd (chassis daemon) on MX, SRX, and EX Series. A local attacker with low privileges can crash chassisd by issuing a crafted show chassis command, causing the affected components (except the Routing En...

CVE-2026-21921

Summary (CVE-2026-21921) : A Use After Free in the chassis daemon (chassisd) of Juniper Junos OS and Junos OS Evolved can allow a network-based attacker with low privileges to cause a Denial-of-Service. The issue arises when telemetry collectors repeatedly subscribe/unsubscribe to sensors, causin...

CVE-2026-33776

CVE-2026-33776 affects Juniper Networks Junos OS and Junos OS Evolved. A Missing Authorization flaw in the CLI allows a local, low-privilege user to read sensitive information by executing the command 'show mgd' with specific arguments. Affected Junos OS versions include all before 22.4R3-S8, 23....

CVE-2025-59962

CVE-2025-59962 affects Juniper Networks Junos OS and Junos OS Evolved with BGP sharding enabled. The issue is an Access of Uninitialized Pointer in the routing protocol daemon (rpd) that can crash and restart rpd when indirect next-hop updates trigger route re-resolution (e.g., an IGP change affe...

CVE-2025-59961

CVE-2025-59961 describes an Incorrect Permission Assignment vulnerability in Juniper’s DHCP daemon (jdhcpd) used by Junos OS and Junos OS Evolved. A local, low-privilege user can write to the Unix socket that manages jdhcpd, enabling administrative control over the DHCP service. Affected products...

CVE-2025-60010

CVE-2025-60010 affects Juniper Junos OS and Junos OS Evolved. A password-aging flaw in the RADIUS client lets an authenticated, network-based attacker log in without enforcing a required password change, using an expired but correct password. Affected versions include: Junos OS pre-22.4R3-S8, 23....

CVE-2025-52963

CVE-2025-52963 – Junos OS UI access control flaw . A local, low-privileged user with a view permission can issue the risky command to disable an interface, causing a Denial-of-Service. Affected software ranges include: all versions before 21.2R3-S9; 21.4 before 21.4R3-S11; 22.2 before 22.2R3-S7; ...

CVE-2025-59959

CVE-2025-59959 describes an Untrusted Pointer Dereference in Juniper Networks Junos OS and Junos OS Evolved routing protocol daemon (rpd). A local, authenticated attacker with low privileges can trigger a crash/restart of rpd by running the command: show route detail when at least one output rou...