Riskcovery

CVE-2025-59969

Junos OS Evolved: QFX5000 Series and PTX Series: An attacker sending crafted multicast packets will cause evo-aftmand / evo-pfemand to crash and restart

State
Published
Severity
7.1 High
Published
Apr 9, 2026
Updated
Apr 10, 2026
Reserved
Sep 23, 2025

Read the record on cve.org

Description

A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in the advanced forwarding toolkit (evo-aftmand/evo-pfemand) of Juniper Networks Junos OS Evolved on PTX Series or QFX5000 Series allows an unauthenticated, adjacent attacker to cause a Denial of Service (DoS).An attacker sending crafted multicast packets will cause line cards running evo-aftmand/evo-pfemand to crash and restart or non-line card devices to crash and restart. Continued receipt and processing of these packets will sustain the Denial of Service (DoS) condition.

This issue affects Junos OS Evolved PTX Series:

* All versions before 22.4R3-S8-EVO, * from 23.2 before 23.2R2-S5-EVO, * from 23.4 before 23.4R2-EVO, * from 24.2 before 24.2R2-EVO, * from 24.4 before 24.4R2-EVO.

This issue affects Junos OS Evolved on QFX5000 Series:

* 22.2-EVO version before 22.2R3-S7-EVO, * 22.4-EVO version before 22.4R3-S7-EVO, * 23.2-EVO versions before 23.2R2-S4-EVO, * 23.4-EVO versions before 23.4R2-S5-EVO, * 24.2-EVO versions before 24.2R2-S1-EVO, * 24.4-EVO versions before 24.4R1-S3-EVO, 24.4R2-EVO.

This issue does not affect Junos OS Evolved on QFX5000 Series versions before: 21.2R2-S1-EVO, 21.2R3-EVO, 21.3R2-EVO, 21.4R1-EVO, and 22.1R1-EVO.

Scores

CVSSScoreVectorSource
4.07.1 HighCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:U/V:C/RE:M/U:Amberjuniper
3.16.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hjuniper

Weaknesses

  • CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Affected Products

ProductVersions
Junos OS EvolvedJuniper Networks
  • before 22.4R3-S8-EVOAffected
  • 23.2 to before 23.2R2-S5-EVOAffected
  • 23.4 to before 23.4R2-EVOAffected
  • 24.2 to before 24.2R2-EVOAffected
  • 24.4 to before 24.4R2-EVOAffected
Junos OS EvolvedJuniper Networks
  • 22.2 to before 22.2R3-S7-EVOAffected
  • 22.4 to before 22.4R3-S7-EVOAffected
  • 23.2 to before 23.2R2-S4-EVOAffected
  • 23.4 to before 23.4R2-S5-EVOAffected
  • 24.2 to before 24.2R2-S1-EVOAffected
  • 24.4 to before 24.4R1-S3-EVO, 24.4R2-EVOAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.