CVE-2025-52986

CWE-401 — Memory Leak4 documents4 sources
Severity
6.8MEDIUM
EPSS
0.0%
top 92.67%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Juniper Networks Junos OSJuniper Networks Junos OS EvolvedJuniper Junos+1 more
Timeline
PublishedJul 11

Description

A Missing Release of Memory after Effective Lifetime vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a local, low privileged user to cause an impact to the availability of the device. When RIB sharding is enabled and a user executes one of several routing related 'show' commands, a certain amount of memory is leaked. When all available memory has been consumed rpd will crash and restart. The leak can be monitored with the CLI command:…

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L

Affected Packages4 packages

▶CVEListV5juniper_networks/junos_os_evolved22.4-EVO — 22.4R3-S7-EVO+5
▶CVEListV5juniper_networks/junos_os21.4 — 21.4R3-S11+7
▶NVDjuniper/junos< 21.2+8

🔴Vulnerability Details

2
CVEList
Junos OS and Junos OS Evolved: When RIB sharding is configured each time a show command is executed RPD memory leaks↗2025-07-11
▶
GHSA
GHSA-mfrf-wpm5-gv78: A Missing Release of Memory after Effective Lifetime vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evol↗2025-07-11
▶

📋Vendor Advisories

1
Juniper
CVE-2025-52986: A Missing Release of Memory after Effective Lifetime vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evol↗2025-07-11
▶
CVE-2025-52986 (MEDIUM CVSS 6.8) | A Missing Release of Memory after E | cvebase.io