CVE-2025-52980

Junos OS: SRX300 Series: rpd will crash upon receiving a specific, valid BGP UPDATE message

HIGH

7.5

CVSS Score

Published: July 11, 2025 at 03:08 PM UTC

Updated: June 17, 2026 at 09:37 AM UTC

1 product affected across 1 vendorJunos

Using Junos OS by Juniper Networks?

Get instant alerts when new vulnerabilities affect Junos OS - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.5

Exploit prediction

EPSS 0.5%

SSVC

No known exploit

Description

A Use of Incorrect Byte Ordering vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS on SRX300 Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). When a BGP update is received over an established BGP session which contains a specific, valid, optional, transitive path attribute, rpd will crash and restart. This issue affects eBGP and iBGP over IPv4 and IPv6. This issue affects: Junos OS: * 22.1 versions from 22.1R1 before 22.2R3-S4, * 22.3 versions before 22.3R3-S3, * 22.4 versions before 22.4R3-S2, * 23.2 versions before 23.2R2, * 23.4 versions before 23.4R2.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Junos · Juniper Networks

95%

22.2 ≤ v < 22.2R3-S422.3 ≤ v < 22.3R3-S322.4 ≤ v < 22.4R3-S223.2 ≤ v < 23.2R223.4 ≤ v < 23.4R222.1 r1 22.1 r1-s1 22.1 r1-s2 22.1 r2 22.1 r2-s1 22.1 r2-s2 22.1 r3 22.1 r3-s1 22.1 r3-s2 22.1 r3-s3 22.2 22.3 22.3 r1 22.3 r1-s1 22.3 r1-s2 22.3 r2 22.3 r2-s1 22.3 r2-s2 22.3 r3 22.3 r3-s1 22.3 r3-s2 22.4 22.4 r1 22.4 r1-s1 22.4 r1-s2 22.4 r2 22.4 r2-s1 22.4 r2-s2 22.4 r3 22.4 r3-s1 23.2 23.2 r1 23.2 r1-s1 23.2 r1-s2 23.4 23.4 r1 23.4 r1-s1 23.4 r1-s2

Vendor states this is fixed in 22.1R1 (unaffected)

Affected range stops below 22.2R3-S4, so it looks safe — our inference, not a vendor statement

Affected range stops below 22.3R3-S3, so it looks safe — our inference, not a vendor statement

Affected range stops below 22.4R3-S2, so it looks safe — our inference, not a vendor statement

Affected range stops below 23.2R2, so it looks safe — our inference, not a vendor statement

Affected range stops below 23.4R2, so it looks safe — our inference, not a vendor statement

juniper-srx300 (environment) · juniper-srx320 (environment) · juniper-srx340 (environment) · juniper-srx345 (environment) · juniper-srx380 (environment)