Junos OS and Junos OS Evolved: a genuine BGP packet resets an established session, sustaining a DoS

Impact

An adjacent unauthenticated attacker can send a specific well-formed BGP packet inside an already established session and reset that session. Repeating the packet keeps the session down, which for a datacenter spine or border router means the routes carried by that peering flap continuously - north-south connectivity for whole racks, or the path to storage and management networks, depending on where the peer sits. Only the targeted session resets, so blast radius is scoped to one peering, but a sustained reset is enough to blackhole traffic that depends on it. eBGP and iBGP, IPv4 and IPv6 are all affected; only the 25.2 train is.

Who can reach it

Unauthenticated, network-adjacent: the attacker must be able to inject into an already established BGP session, so a compromised peer, a device on the peering segment, or anyone able to spoof onto that path.

What to do

Upgrade to Junos OS 25.2R2 or Junos OS Evolved 25.2R2-EVO, which means a routing-engine software upgrade and a maintenance window per device - plan for a reboot or at minimum a control-plane restart and pre-stage it for redundant pairs. Releases before 25.2R1 are not affected, so a device still on an earlier train needs nothing. Meanwhile, restrict who can reach the BGP sessions (authentication, GTSM/TTL security, infrastructure ACLs).

References

Related entries

• Junos OS MX Series PFE: micro-BFD flapping starves PFEMAN until the watchdog crashes and restarts the FPCCVE-2026-33800 · Juniper Junos OS on MX Series (Packet Forwarding Engine, PFEMAN micro-BFD event processing)High
• Dell iDRAC10 (credential handling, race condition): A race in iDRAC10's credential handling leaves secretsCVE-2026-35155 · Dell iDRAC10 (credential handling, race condition)High
• Linux kernel InfiniBand core (ib_uverbs post_send): ib_uverbs_post_send() takes the work-queue-entry size straightCVE-2026-45856 · Linux kernel InfiniBand core (ib_uverbs post_send)High
• Linux kernel RDMA core (UVERBS_ATTR_ALLOC_DMAH_CPU_ID, DMA handle allocation): The cpu_id a tenant passes whenCVE-2026-53187 · Linux kernel RDMA core (UVERBS_ATTR_ALLOC_DMAH_CPU_ID, DMA handle allocation)High
• Dell OpenManage Enterprise: SQL injection reachable by a low-privileged remote userCVE-2026-56088 · Dell OpenManage Enterprise (web console, SQL injection)High
• Linux kernel InfiniBand MAD layer (kernel RMPP receive reassembly, ib_mad): This is a pre-authentication flaw on theCVE-2026-68425 · Linux kernel InfiniBand MAD layer (kernel RMPP receive reassembly, ib_mad)High