CVE-2026-33801: Juniper Junos BGP Daemon DoS Vulnerability (25.2)

Technical summary

CVE-2026-33801 is an improper exception handling vulnerability (CWE-754) in the Routing Protocol Daemon (RPD) of Juniper Junos OS and Junos OS Evolved. A non-inet/inet6 unicast BGP UPDATE message received over an already-established BGP session triggers a crash and automatic restart of the RPD process. Because the malformed packet causes the crash before any processing or readvertisement occurs, the attack has no propagation beyond the targeted router. The vulnerability requires adjacent network access and an active BGP peer relationship, but no BGP authentication bypass is needed if authentication is not configured on the session.

Business impact

This vulnerability creates a targeted denial-of-service risk for organizations running affected Juniper devices at network boundaries or as core routing infrastructure. An attacker with network proximity (same AS, peering network, or other adjacent vantage point) can force service disruption without authentication, causing temporary loss of all routes through that device and forcing reconvergence time for backup paths. In hub-and-spoke networks or single-path architectures, this can cascade outages. The impact is bounded in duration—automatic restart recovers functionality—but can disrupt time-sensitive services during the recovery window (typically seconds to minutes depending on routing table size).

Affected systems

Juniper Junos OS versions 25.2 up to (but not including) 25.2R2, and Junos OS Evolved versions 25.2 up to (but not including) 25.2R2-EVO are affected. All earlier versions (before 25.2R1 for standard Junos OS and before 25.2R1-EVO for Evolved) are not vulnerable. This impacts recently updated systems; older long-term support branches are unaffected unless customers have explicitly upgraded to the 25.2 release train.

Exploitability

Exploitation requires the attacker to be on an adjacent network (typically a BGP peer or shared Layer 2 segment) and assumes an active BGP session is established with the target router. No authentication bypass is necessary if the BGP session lacks authentication (MD5 or other mechanisms). The attack is trivial to execute once conditions are met—sending a single crafted BGP UPDATE packet. However, the requirement for active BGP peering limits the attack surface to known peer networks and direct adjacencies, excluding remote internet-wide attacks. The CVSS score of 6.5 (MEDIUM) reflects high availability impact but low exploitability scope.

Remediation

Apply security patch versions 25.2R2 or later for Junos OS, or 25.2R2-EVO or later for Junos OS Evolved. Organizations unable to upgrade immediately should verify BGP authentication is enabled on all external and untrusted peer sessions (RFC 2385 MD5 or BGPsec). Restrict BGP peering to trusted adjacencies and monitor for unexpected BGP session resets from peer devices. Consider temporarily disabling BGP from untrusted sources if operationally feasible. Because this affects only the 25.2 release branch, remaining on earlier LTS versions provides mitigation.

Patch guidance

Juniper has released patched versions 25.2R2 (Junos OS) and 25.2R2-EVO (Junos OS Evolved). Verify availability in your support portal and validate in a lab environment before production deployment, as routing daemon patches typically require graceful BGP neighbor reset. Plan patching during a maintenance window to allow session reconvergence. Confirm post-upgrade that BGP sessions stabilize and routing table completeness is restored.

Detection guidance

Monitor Juniper syslog for unexpected RPD process restarts (look for 'rpd died' or 'rpd restarted' messages) without a corresponding configuration change or administrative reload command. Instrument BGP session monitoring to detect brief but repeated peer resets from the same neighbor. Correlate BGP neighbor flaps with RPD restarts. If you receive unusual or rejected BGP UPDATE messages in logs, investigate the source peer. Enable debug logging for BGP at the receive point if investigation is ongoing, but disable after troubleshooting due to CPU overhead.

Why prioritize this

This vulnerability should be prioritized for patching in the next maintenance window but does not require emergency out-of-hours response. The attack surface is limited to known BGP peers; the impact is a temporary outage, not data exfiltration or lateral movement; and affected versions are limited to recent 25.2 releases, which suggests most organizations are still on older stable branches. However, if your organization peers with untrusted or public BGP exchanges, or uses 25.2 for critical backbone routing, advance this to high priority. Kev status is not flagged, indicating no widespread exploitation has been observed.

Risk score, explained

CVSS 6.5 (MEDIUM) reflects a complete availability impact (rpd crash = routing outage, +3.6 base) tempered by a narrowly constrained attack surface: adjacent access only (AV:A), no additional conditions (AC:L), no authentication required (PR:N), no scope escalation (S:U), and no confidentiality or integrity harm (C:N, I:N). The score appropriately penalizes the high availability damage but recognizes that exploitability is confined to active BGP peers, not the public internet.

Frequently asked questions