Junos OS Evolved on PTX: packets rejected by an output filter are punted to the Routing Engine

CVSS 6.9CVE-2025-59958Firmware, BMC & network fabriccurated

Impact

On a PTX core or spine router, any traffic matching an output firewall filter term whose action is 'reject' is incorrectly handed to the Routing Engine instead of being dropped in the forwarding plane. An unauthenticated attacker on the network can therefore spend RE CPU and memory - limited resources that the control plane shares with routing protocol processing - simply by sending traffic that the filter is supposed to discard. The RE's replies to that traffic can also disclose information about the device. In a GPU fabric this sits on the north-south or inter-pod path, so degrading the RE of a PTX box affects routing for every tenant behind it, and the filter that operators installed as a security control is the thing that creates the exposure. Only filters on WAN or revenue interfaces are affected, not management or lo0 filters and not input filters.

Who can reach it

Anyone who can send packets to a WAN or revenue interface of the affected PTX router that match a 'reject' term of an output firewall filter. No authentication required.

What to do

Upgrade Junos OS Evolved to 22.4R3-EVO or later, or to 23.2R2-EVO or later on the 23.2 branch, per JSA103147 - a Junos upgrade means a maintenance window with the router out of service unless it is deployed redundantly. As an interim measure, review output filters on revenue interfaces and use 'discard' rather than 'reject' where the ICMP response is not needed.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-59958 https://supportportal.juniper.net/JSA103147

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.