Junos OS CVE-2026-33795

Exploitation requires the target Junos OS / Junos OS Evolved device (version 20.4R1 / 20.4R1-EVO or later) to be running BGP and processing Prefix-SID (Segment Routing) route advertisements; the attacker must be able to inject or influence a BGP Prefix-SID route that is received and then re-advertised by the vulnerable rpd process. Limiting factors: devices without BGP Prefix-SID in use are not exposed; the crafted route must be accepted into the BGP control plane and re-advertised, which in realistic deployments implies a BGP adjacency or upstream position rather than arbitrary off-path Internet access; versions prior to 20.4R1/20.4R1-EVO are explicitly unaffected. No authentication to the device is required (PR:N) and no user interaction is needed.

This is a credible operational priority for networks running BGP with Prefix-SID (Segment Routing), but it is narrower than the 8.7 CVSS 4.0 score alone suggests. The vendor vector (AV:N/AC:L/PR:N/UI:N) confirms an unauthenticated, network-reachable trigger with low complexity, and impact is availability-only (VA:H, SA:L) - there is NO confidentiality or integrity impact (VC:N/VI:N/SI:N), so this is a pure denial-of-service affecting the rpd routing process. The 4.0 vector additionally flags AU:Y (automatable) and R:A (automatic/assisted recovery) with V:C (concentrated value), consistent with a crash that may self-recover but can be repeatedly triggered. EPSS is not provided, KEV status is not present, and no POC is indicated, so exploitation likelihood cannot be quantified from the data - there is no public exploit identified at time of analysis. The key nuance NOT captured by the raw CVSS: the trigger is a BGP Prefix-SID route 'that is subsequently re-advertised,' meaning the attacker must get a crafted route accepted into and propagated through the BGP control plane to reach the vulnerable rpd - in practice this implies a BGP adjacency or upstream position rather than arbitrary Internet-wide reachability, which tempers the PR:N/AV:N 'anyone-on-the-network' reading. Treat as a patch-soon item for Segment-Routing BGP deployments; de-prioritize where Prefix-SID is not configured.

An attacker positioned to inject or influence BGP routes (e.g., a malicious or compromised BGP peer, or an upstream that originates a crafted advertisement) sends a BGP Prefix-SID route advertisement containing a value that triggers a numeric truncation error in the rpd process. When a vulnerable Junos OS or Junos OS Evolved router re-advertises that route, rpd mishandles it and crashes, disrupting routing. No public exploit code is identified at time of analysis, and the vector requires BGP Prefix-SID processing to be in the path.