CVE-2025-52980 Junos OS: SRX300 Series: rpd will crash upon receiving a specific, valid BGP UPDATE message

High 8.7 Published 11 Jul 2025 Updated 15 Jul 2025

An unauthenticated attacker can crash the routing daemon on Juniper SRX300 devices by sending a specific BGP update message, causing a denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-52980?

CVE-2025-52980 is a high-severity denial of service vulnerability in Juniper Junos, published on 11 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A Use of Incorrect Byte Ordering

vulnerability

in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS on SRX300 Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).

When a BGP update is received over an established BGP session which contains a specific, valid, optional, transitive path attribute, rpd will crash and restart.

This issue affects eBGP and iBGP over IPv4 and IPv6.

This issue affects:

Junos OS:

* 22.1 versions from 22.1R1 before 22.2R3-S4, * 22.3 versions before 22.3R3-S3, * 22.4 versions before 22.4R3-S2, * 23.2 versions before 23.2R2, * 23.4 versions before 23.4R2.

Weakness: CWE-198

Which versions are affected by CVE-2025-52980?

It affects 1 product.

Products include Juniper Junos.

How do I fix CVE-2025-52980?

No fix has been published for CVE-2025-52980 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2025-52980 being exploited?

There is no known exploitation of CVE-2025-52980 in the wild and no public exploit code.

All Juniper Junos vulnerabilities

Sources

Also known as GHSA-p6jr-6crg-pfcj.