CVE-2025-52986 in Junos OS
Summary
by MITRE • 07/11/2025
A Missing Release of Memory after Effective Lifetime vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a local, low privileged user to cause an impact to the availability of the device.
When RIB sharding is enabled and a user executes one of several routing related 'show' commands, a certain amount of memory is leaked. When all available memory has been consumed rpd will crash and restart.
The leak can be monitored with the CLI command:
show task memory detail | match task_shard_mgmt_cookie
where the allocated memory in bytes can be seen to continuously increase with each exploitation.
This issue affects:
Junos OS:
* all versions before 21.2R3-S9, * 21.4 versions before 21.4R3-S11, * 22.2 versions before 22.2R3-S7, * 22.4 versions before 22.4R3-S7, * 23.2 versions before 23.2R2-S4, * 23.4 versions before 23.4R2-S4, * 24.2 versions before 24.2R2, * 24.4 versions before 24.4R1-S2, 24.4R2;
Junos OS Evolved:
* all versions before 22.2R3-S7-EVO * 22.4-EVO versions before 22.4R3-S7-EVO, * 23.2-EVO versions before 23.2R2-S4-EVO, * 23.4-EVO versions before 23.4R2-S4-EVO, * 24.2-EVO versions before 24.2R2-EVO, * 24.4-EVO versions before 24.4R2-EVO.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 04/29/2026
The vulnerability identified as CVE-2025-52986 represents a critical memory management flaw within the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved platforms. This issue manifests as a missing release of memory after effective lifetime, a pattern that falls under CWE-401, which specifically addresses insufficient memory deallocation. The vulnerability is particularly concerning because it allows local, low-privileged users to exploit memory leaks that can ultimately lead to device crashes and service disruption. The flaw is triggered when RIB (Routing Information Base) sharding is enabled, a feature commonly used in enterprise routing environments to improve performance and scalability. The memory leak occurs specifically during execution of routing-related 'show' commands, indicating that routine administrative operations can inadvertently cause system instability.
The technical mechanism behind this vulnerability involves the improper handling of memory allocation within the task_shard_mgmt_cookie structure, which is responsible for managing routing shard information. When users execute certain show commands while RIB sharding is active, the rpd process allocates memory but fails to properly release it after use. This creates a gradual accumulation of memory consumption that can be monitored through the CLI command show task memory detail | match task_shard_mgmt_cookie. The continuous increase in allocated memory bytes demonstrates the progressive nature of the leak, making it a classic case of memory exhaustion that can be systematically exploited. The vulnerability operates at the kernel level within the routing daemon, making it particularly difficult to detect and mitigate without proper monitoring and patching procedures.
The operational impact of this vulnerability extends beyond simple performance degradation to potentially compromising network availability and stability. As memory consumption increases with each command execution, the system eventually reaches a point where available memory is exhausted, causing the rpd process to crash and restart automatically. This restart process can result in temporary loss of routing services, disruption of network connectivity, and potential cascading effects throughout the network infrastructure. The vulnerability's exploitation is particularly dangerous in production environments where routing stability is paramount, as it can lead to unexpected outages and require immediate intervention from network administrators. The timing of the crash is directly proportional to the number of commands executed, making it a predictable yet insidious threat to network reliability.
Mitigation strategies for CVE-2025-52986 should focus on immediate patch deployment across all affected Junos OS and Junos OS Evolved versions, as outlined in the vendor's security advisories. Network administrators should prioritize patching of all impacted systems, particularly those running with RIB sharding enabled, as this configuration directly triggers the vulnerability. Monitoring should be implemented to track memory usage patterns through the specified CLI commands, allowing for early detection of potential exploitation attempts. Additionally, operational procedures should include limiting execution of routing-related show commands to essential administrative tasks only, reducing exposure windows. From a security perspective, this vulnerability aligns with ATT&CK technique T1499.004, which covers network denial of service attacks, and represents a form of resource exhaustion attack that can be classified under the broader category of availability attacks. Organizations should also consider implementing automated patch management processes to prevent similar vulnerabilities from remaining unaddressed in the future, as the memory leak pattern suggests that this issue could be systematically exploited over time.