Skip to main content

Junos CVE-2025-52986

| EUVDEUVD-2025-21144 MEDIUM
Memory Leak (CWE-401)
2025-07-11 sirt@juniper.net
Denial Of Service Juniper Junos Junos Os Evolved
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Patch available
Apr 16, 2026 - 05:29 EUVD
23.4R2-S4,22.4R3-S7,22.2R3-S7
EUVD ID Assigned
Mar 16, 2026 - 08:18 euvd
EUVD-2025-21144
Analysis Generated
Mar 16, 2026 - 08:18 vuln.today
CVE Published
Jul 11, 2025 - 16:15 nvd
MEDIUM 5.5

DescriptionCVE.org

A Missing Release of Memory after Effective Lifetime vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a local, low privileged user to cause an impact to the availability of the device.

When RIB sharding is enabled and a user executes one of several routing related 'show' commands, a certain amount of memory is leaked. When all available memory has been consumed rpd will crash and restart.

The leak can be monitored with the CLI command:

show task memory detail | match task_shard_mgmt_cookie

where the allocated memory in bytes can be seen to continuously increase with each exploitation.

This issue affects:

Junos OS:

  • all versions before 21.2R3-S9,
  • 21.4 versions before 21.4R3-S11,
  • 22.2 versions before 22.2R3-S7,
  • 22.4 versions before 22.4R3-S7,
  • 23.2 versions before 23.2R2-S4,
  • 23.4 versions before 23.4R2-S4,
  • 24.2 versions before 24.2R2,
  • 24.4 versions before 24.4R1-S2, 24.4R2;

Junos OS Evolved:

  • all versions before 22.2R3-S7-EVO
  • 22.4-EVO versions before 22.4R3-S7-EVO,
  • 23.2-EVO versions before 23.2R2-S4-EVO,
  • 23.4-EVO versions before 23.4R2-S4-EVO,
  • 24.2-EVO versions before 24.2R2-EVO,
  • 24.4-EVO versions before 24.4R2-EVO.

Analysis

A Missing Release of Memory after Effective Lifetime vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a local, low privileged user to cause an impact to the availability of the device.

When RIB sharding is enabled and a user executes one of several routing related 'show' commands, a certain amount of memory is leaked. When all available memory has been consumed rpd will crash and restart.

The leak can be monitored with the CLI command:

show task memory detail | match task_shard_mgmt_cookie

where the allocated memory in bytes can be seen to continuously increase with each exploitation.

This issue affects:

Junos OS:

  • all versions before 21.2R3-S9,
  • 21.4 versions before 21.4R3-S11,
  • 22.2 versions before 22.2R3-S7,
  • 22.4 versions before 22.4R3-S7,
  • 23.2 versions before 23.2R2-S4,
  • 23.4 versions before 23.4R2-S4,
  • 24.2 versions before 24.2R2,
  • 24.4 versions before 24.4R1-S2, 24.4R2;

Junos OS Evolved:

  • all versions before 22.2R3-S7-EVO
  • 22.4-EVO versions before 22.4R3-S7-EVO,
  • 23.2-EVO versions before 23.2R2-S4-EVO,
  • 23.4-EVO versions before 23.4R2-S4-EVO,
  • 24.2-EVO versions before 24.2R2-EVO,
  • 24.4-EVO versions before 24.4R2-EVO.

Technical ContextAI

A denial of service vulnerability allows an attacker to disrupt the normal functioning of a system, making it unavailable to legitimate users. This vulnerability is classified as Memory Leak (CWE-401).

RemediationAI

Implement rate limiting and input validation. Use timeout mechanisms for resource-intensive operations. Deploy DDoS protection where applicable.

More in Junos

View all
CVE-2016-1285 MEDIUM
6.8 Mar 09

named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 does not properly handle DNAME records when parsing fe
CVE-2016-1286 HIGH
8.6 Mar 09

named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 allows remote attackers to cause a denial of service (
CVE-2023-36845 CRITICAL POC
9.8 Aug 17

A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series and SRX Series all
CVE-2013-6618 CRITICAL POC
9.0 Nov 05

jsdm/ajax/port.php in J-Web in Juniper Junos before 10.4R13, 11.4 before 11.4R7, 12.1 before 12.1R5, 12.2 before 12.2R3,
CVE-2014-6380 HIGH POC
7.8 Oct 14

Juniper Junos 11.4 before R11, 12.1 before R9, 12.1X44 before D30, 12.1X45 before D20, 12.1X46 before D15, 12.1X47 befor
CVE-2021-0253 HIGH POC
7.8 Apr 22

NFX Series devices using Juniper Networks Junos OS are susceptible to a local command execution vulnerability thereby al
CVE-2021-0252 HIGH POC
7.8 Apr 22

NFX Series devices using Juniper Networks Junos OS are susceptible to a local code execution vulnerability thereby allow
CVE-2019-0053 HIGH POC
7.8 Jul 11

Insufficient validation of environment variables in the telnet client supplied in Junos OS can lead to stack-based buffe
CVE-2023-22415 HIGH POC
7.5 Jan 13

An Out-of-Bounds Write vulnerability in the H.323 ALG of Juniper Networks Junos OS allows an unauthenticated, network-ba
CVE-2022-22223 HIGH POC
7.5 Oct 18

On QFX10000 Series devices using Juniper Networks Junos OS when configured as transit IP/MPLS penultimate hop popping (P
CVE-2022-22209 HIGH POC
7.5 Jul 20

A Missing Release of Memory after Effective Lifetime vulnerability in the kernel of Juniper Networks Junos OS allows an

CVE-2022-22188 HIGH POC
7.5 Apr 14

An Uncontrolled Memory Allocation vulnerability leading to a Heap-based Buffer Overflow in the packet forwarding engine

Same weakness CWE-401 – Memory Leak

View all
CVE-2020-13934 HIGH
7.5
CVE-2016-4232 HIGH POC
7.5
CVE-2024-25450 HIGH POC
8.8
CVE-2023-33718 HIGH POC
8.8
CVE-2019-6128 HIGH POC
8.8
CVE-2026-67183 HIGH POC
8.7
CVE-2023-34451 HIGH POC
8.2
CVE-2023-41484 HIGH POC
8.1

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Share

CVE-2025-52986 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy