CVE-2024-39515

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An Improper Validation of Consistency within Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker sending a specifically malformed BGP packet to cause rpd to crash and restart, resulting in a Denial of Service (DoS). Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition.

In some cases, rpd fails to restart requiring a manual restart via the 'restart routing' CLI command.

This issue only affects systems with BGP traceoptions enabled and

requires a BGP session to be already established. Systems without BGP traceoptions enabled are not affected by this issue.

This issue affects iBGP and eBGP, and both IPv4 and IPv6 are affected by this vulnerability.

This issue affects:

Junos OS: 

* All versions before 21.4R3-S8,  * 22.2 before 22.2R3-S5,  * 22.3 before 22.3R3-S4,  * 22.4 before 22.4R3-S3,  * 23.2 before 23.2R2-S2,  * 23.4 before 23.4R2; 

Junos OS Evolved: 

* All versions before 21.4R3-S8-EVO,  * 22.2-EVO before 22.2R3-S5-EVO,  * 22.3-EVO before 22.3R3-S4-EVO,  * 22.4-EVO before 22.4R3-S3-EVO,  * 23.2-EVO before 23.2R2-S2-EVO,  * 23.4-EVO before 23.4R2-EVO.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-1288

Affected software

VendorProductVersions
Juniper NetworksJunos OS< 21.4R3-S8; >= 22.2, < 22.2R3-S5; >= 22.3, < 22.3R3-S4; >= 22.4, < 22.4R3-S3; >= 23.2, < 23.2R2-S2; >= 23.4, < 23.4R2
Juniper NetworksJunos OS Evolved< 21.4R3-S8-EVO; >= 22.2-EVO, < 22.2R3-S5-EVO; >= 22.3-EVO, < 22.3R3-S4-EVO; >= 22.4-EVO, < 22.4R3-S3-EVO; >= 23.2-EVO, < 23.2R2-S2-EVO; >= 23.4-EVO, < 23.4R2-EVO
juniperjunos< 21.4R3-S8; >= 22.2, < 22.2R3-S5; >= 22.3, < 22.3R3-S4; >= 22.4, < 22.4R3-S3; >= 23.2, < 23.2R2-S2; >= 23.4, < 23.4R2
juniperjunos_os_evolved< 21.4R3-S8; >= 22.2, < 22.2R3-S5; >= 22.3, < 22.3R3-S4; >= 22.4, < 22.4R3-S3; >= 23.2, < 23.2R2-S2; >= 23.4, < 23.4R2

References

Timeline

Published
Oct 9, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-395167.5An Out-of-Bounds Read vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unaCVE-2024-395176.5An Improper Check for Unusual or Exceptional Conditions vulnerability in the Layer 2 Address Learning Daemon (l2ald) on Juniper Networks JunCVE-2024-395187.5A Heap-based Buffer Overflow vulnerability in the telemetry sensor process (sensord) of Juniper Networks Junos OS on MX240, MX480, MX960 plaCVE-2024-395196.5An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS EvoCVE-2024-39526.4The Advanced Ads – Ad Manager & AdSense plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Advanced Ad widget in all CVE-2024-395207.8An Improper Neutralization of Special Elements vulnerability in Juniper Networks Junos OS Evolved commands allows a local, authenticated attCVE-2024-395217.8An Improper Neutralization of Special Elements vulnerability in Juniper Networks Junos OS Evolved commands allows a local, authenticated attCVE-2024-395227.8An Improper Neutralization of Special Elements vulnerability in Juniper Networks Junos OS Evolved commands allows a local, authenticated attCVE-2024-395237.8An Improper Neutralization of Special Elements vulnerability in Juniper Networks Junos OS Evolved commands allows a local, authenticated attCVE-2024-395247.8An Improper Neutralization of Special Elements vulnerability in Juniper Networks Junos OS Evolved commands allows a local, authenticated attCVE-2024-395257.5An Improper Handling of Exceptional Conditions vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS CVE-2024-395266.5An Improper Handling of Exceptional Conditions vulnerability in packet processing of Juniper Networks Junos OS on MX Series with MPC10/MPC11