Report feedback

An unauthenticated remote attacker can exhaust kernel memory and carry out a DoS attack in Junos OS Evolved by sending specially crafted IPv6 packets. Only systems configured with the IPv6 protocol are vulnerable [2].

The vulnerability is present in product:

• Junos OS Evolved; >=22.4-EVO, <22.4R3-S5-EVO; >=23.2-EVO, <23.2R2-S2-EVO; >=23.4-EVO, <23.4R2-S2-EVO; >=24.2-EVO, <24.2R1-S2-EVO;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

More information:

• CVE-2025-21599 at cve.org, NVD
• CWE-401: Missing Release of Memory after Effective Lifetime at cwe.mitre.org

The vulnerability was publicly disclosed 8. 1. 2025.

An unauthenticated remote attacker can carry out a DoS attack in Junos OS and Junos OS Evolved by sending specially crafted BGP packets. The packets may propagate between autonomous systems, thereby increasing the impact of the vulnerability. Only systems with BGP trace options enabled are vulnerable [1][3]. IoCs of a possible attack can be found at [1].

The vulnerability is present in products:

• Junos OS; >=21.2R3-S8, <21.2R3-S9; >=21.4R3-S7, <21.4R3-S9; >=22.2R3-S4, <22.2R3-S5; >=22.3R3-S2, <22.3R3-S4; >=22.4R3, <22.4R3-S5; >=23.2R2, <23.2R2-S2; >=23.4R1, <23.4R2-S1; >=24.2R1, <24.2R1-S1;
• Junos OS Evolved; >=21.4R3-S7-EVO, <21.4R3-S9-EVO; >=22.2R3-S4-EVO, <22.2R3-S5-EVO; >=22.3R3-S2-EVO, <22.3R3-S4-EVO; >=22.4R3-EVO, <22.4R3-S5-EVO; >=23.2R2-EVO, <23.2R2-S2-EVO; >=23.4R1-EVO, <23.4R2-S1-EVO; >=24.2R1-EVO, <24.2R1-S2-EVO;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

More information:

• CVE-2025-21598 at cve.org, NVD
• CWE-125: Out-of-bounds Read at cwe.mitre.org

The vulnerability was publicly disclosed 8. 1. 2025.