Juniper Junos OS/Junos OS Evolved Routing Protocol memory leak

Summaryinfo

A vulnerability was found in Juniper Junos OS and Junos OS Evolved. It has been classified as problematic. Impacted is an unknown function of the component Routing Protocol Handler. Performing a manipulation results in memory leak. This vulnerability is reported as CVE-2025-52986. The attack requires a local approach. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Juniper Junos OS and Junos OS Evolved (unknown version). It has been classified as problematic. This affects an unknown code block of the component Routing Protocol Handler. The manipulation with an unknown input leads to a memory leak vulnerability. CWE is classifying the issue as CWE-401. The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory. This is going to have an impact on availability. The summary by CVE is:

A Missing Release of Memory after Effective Lifetime vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a local, low privileged user to cause an impact to the availability of the device. When RIB sharding is enabled and a user executes one of several routing related 'show' commands, a certain amount of memory is leaked. When all available memory has been consumed rpd will crash and restart. The leak can be monitored with the CLI command: show task memory detail | match task_shard_mgmt_cookie where the allocated memory in bytes can be seen to continuously increase with each exploitation. This issue affects: Junos OS: * all versions before 21.2R3-S9, * 21.4 versions before 21.4R3-S11, * 22.2 versions before 22.2R3-S7, * 22.4 versions before 22.4R3-S7, * 23.2 versions before 23.2R2-S4,  * 23.4 versions before 23.4R2-S4, * 24.2 versions before 24.2R2, * 24.4 versions before 24.4R1-S2, 24.4R2; Junos OS Evolved: * all versions before 22.2R3-S7-EVO * 22.4-EVO versions before 22.4R3-S7-EVO, * 23.2-EVO versions before 23.2R2-S4-EVO, * 23.4-EVO versions before 23.4R2-S4-EVO, * 24.2-EVO versions before 24.2R2-EVO,  * 24.4-EVO versions before 24.4R2-EVO.

It is possible to read the advisory at supportportal.juniper.net. This vulnerability is uniquely identified as CVE-2025-52986 since 06/23/2025. The exploitability is told to be easy. Attacking locally is a requirement. The technical details are unknown and an exploit is not publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 310747 (Juniper Junos OS Vulnerability (JSA100092)), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (310747) and CERT Bund (WID-SEC-2025-1519). Be aware that VulDB is the high quality source for vulnerability data.

Affected

• Juniper MX Series
• Juniper JUNOS
• Juniper SRX Series
• Juniper Security Director
• Juniper Junos Space

Productinfo

Type

• Router Operating System

Vendor

• Juniper

Name

• Junos OS
• Junos OS Evolved

License

• commercial

Website

• Vendor: https://www.juniper.net/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion