CVE-2025-30651

A Buffer Access with Incorrect Length Value vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS). When an attacker sends a specific ICMPv6 packet to an interface with "protocols router-advertisement" configured, rpd crashes and restarts. Continued receipt of this packet will cause a sustained DoS condition.  This issue only affects systems configured with IPv6. This issue affects Junos OS:  * All versions before 21.2R3-S9,  * from 21.4 before 21.4R3-S10, * from 22.2 before 22.2R3-S6, * from 22.4 before 22.4R3-S4, * from 23.2 before 23.2R2-S2, * from 23.4 before 23.4R2; and Junos OS Evolved: * All versions before 21.2R3-S9-EVO, * from 21.4-EVO before 21.4R3-S10-EVO, * from 22.2-EVO before 22.2R3-S6-EVO, * from 22.4-EVO before 22.4R3-S4-EVO, * from 23.2-EVO before 23.2R2-S2-EVO, * from 23.4-EVO before 23.4R2-EVO.

Scoring

Severity

HIGH

CVSS base score

8.7

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L

EPSS probability

0.42%

CWE

CWE-805

Published

2025-04-09

Last modified

2026-03-12

Affected products

• Juniper Networks Junos OS
• Juniper Networks Junos OS
• Juniper Networks Junos OS
• Juniper Networks Junos OS
• Juniper Networks Junos OS
• Juniper Networks Junos OS
• Juniper Networks Junos OS Evolved
• Juniper Networks Junos OS Evolved

Weakness type

• CWE-805

Related vulnerabilities

• CVE-2026-6695 — Gimp: gimp: remote code execution via crafted paa file
• CVE-2026-15028 — Libarchive: heap overflow oob read while parsing a tar archive contains a pax extended header
• CVE-2026-53877 — Heap buffer over-read in GDALRaster
• CVE-2026-12549 — Libsoup: incomplete fix for cve-2026-2443: range suffix overflow in libsoup soupserver
• CVE-2026-1767 — Localsearch: tracker-miners: gnome localsearch mp3 extractor: heap buffer overflow leading to denial of service or information disclosure via malformed mp3 id3 tags
• CVE-2026-1766 — Localsearch: tracker-miners: gnome localsearch mp3 extractor: denial of service and information disclosure via malformed mp3 files.
• CVE-2026-12087 — Socket versions before 2.041 for Perl have an out-of-bounds heap read
• CVE-2026-34002 — Xorg: xwayland: x.org x server: information disclosure or denial of service via out-of-bounds read in xkb modifier map handling

Markdown version · Browse all CVEs