Junos OS (SRX firewalls)
CVE-2025-60003: BGP update with a set of specific attributes causes rpd crash
A Buffer Over-read vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Junos OS 0 | 22.4R3-S8 or later |
| Junos OS 23.2 | 23.2R2-S5 or later |
| Junos OS 23.4 | 23.4R2-S6 or later |
| Junos OS 24.2 | 24.2R2-S2 or later |
| Junos OS 24.4 | 24.4R2 or later |
| Junos OS Evolved 0 | 22.4R3-S8-EVO or later |
| Junos OS Evolved 23.2 | 23.2R2-S5-EVO or later |
| Junos OS Evolved 23.4 | 23.4R2-S6-EVO or later |
| Junos OS Evolved 24.2 | 24.2R2-S2-EVO or later |
| Junos OS Evolved 24.4 | 24.4R2-EVO or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
A Buffer Over-read vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).
When an affected device receives a BGP update with a set of specific optional transitive attributes over an established peering session, rpd will crash and restart when attempting to advertise the received information to another peer. This issue can only happen if one or both of the BGP peers of the receiving session are non-4-byte-AS capable as determined from the advertised capabilities during BGP session establishment. Junos OS and Junos OS Evolved default behavior is 4-byte-AS capable unless this has been specifically disabled by configuring:
[ protocols bgp ... disable-4byte-as ]
Established BGP sessions can be checked by executing:
show bgp neighbor <IP address> | match "4 byte AS"
This issue affects:
Junos OS:
- all versions before 22.4R3-S8,
- 23.2 versions before 23.2R2-S5,
- 23.4 versions before 23.4R2-S6,
- 24.2 versions before 24.2R2-S2,
- 24.4 versions before 24.4R2;
Junos OS Evolved:
- all versions before 22.4R3-S8-EVO,
- 23.2 versions before 23.2R2-S5-EVO,
- 23.4 versions before 23.4R2-S6-EVO,
- 24.2 versions before 24.2R2-S2-EVO,
- 24.4 versions before 24.4R2-EVO.
Am I affected?
To be exposed to this issue at least two BGP peers needs to be configured via:
[ protocols bgp ... neighbor ... ]
Workarounds
There are no known workarounds for this issue.
Exploitation
Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.