CVE-2025-59960
HighSummary
A vulnerability in the DHCP service (jdhcpd) of Junos OS and Junos OS Evolved allows a DHCP client in one subnet to exhaust the address pools of other subnets, leading to a Denial of Service (DoS) on the downstream DHCP server. The issue arises from improper handling of DHCP DISCOVER packets with Option 82 in 'forward-only' mode, which are forwarded unmodified instead of being dropped, consuming addresses from the pool.
Risk Assessment
An attacker-controlled DHCP client can exhaust IP address pools, preventing new clients from obtaining addresses and causing network disruption (DoS).
Recommendation
Upgrade Junos OS or Junos OS Evolved to a patched version as per vendor advisory. Additionally, if possible, configure 'trust-option82' only for trusted clients or restrict 'forward-only' mode.
Other vulnerabilities in Junos OS
See all- CVE-2026-21917High
A vulnerability in the Web-Filtering module of Junos OS on SRX Series allows an unauthenticated network-based attacker to cause a Denial-of-Service (DoS). A specially crafted SSL packet causes an FPC crash and restart.
- CVE-2026-21913High
A vulnerability in Juniper Junos OS on EX4000 models with 48 ports (EX4000-48T, EX4000-48P, EX4000-48MP) allows an unauthenticated network-based attacker to cause an FXPC crash and restart by sending a high volume of traffic to the device. This leads to a complete service outage until the device automatically restarts.
- CVE-2026-21905High
A vulnerability in Junos OS on SRX and MX devices with MX-SPC3 or MS-MPC service cards causes an infinite loop in the flow management process (flowd or mspmand) after receiving specific SIP messages over TCP. An unauthenticated attacker can send multiple such messages, leading to watchdog timer expiration and process crash, resulting in a Denial of Service (DoS). The issue only occurs over TCP, not UDP.
- CVE-2025-60003High
A Buffer Over-read vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). When an affected device receives a BGP update with a set of specific optional transitive attributes over an established peering session, rpd will crash and restart when attempting to advertise the received information to another peer.
- CVE-2016-4922High
A vulnerability in Junos OS allows unauthorized access to the operating system through certain combinations of CLI commands. Users with the appropriate permissions can achieve elevated privileges and gain complete control of the device.
- CVE-2017-2344High
An internal Junos OS sockets library is vulnerable to a buffer overflow, which may lead to a denial of service (kernel panic) or privilege escalation through local code execution. The routines are only accessible via programs running on the device.
- CVE-2017-2303High
On Juniper Networks products or platforms running Junos OS versions prior to 12.1X46-D50, 12.1X47-D40, 12.3R13, 12.3X48-D30, 13.2X51-D40, 13.3R10, 14.1R8, 14.1X53-D35, 14.1X55-D35, 14.2R5, 15.1F6, 15.1R3, 15.1X49-D30, 15.1X49-D40, 15.1X53-D35, where RIP is enabled, certain RIP advertisements may cause the RPD daemon to crash, resulting in a denial of service condition.
- CVE-2017-2302High
On Juniper Networks products running Junos OS versions prior to 12.1X46-D55, 12.1X47-D45, 12.3R13, 12.3X48-D35, 13.3R10, 14.1R8, 14.1X53-D40, 14.1X55-D35, 14.2R6, 15.1F2 or 15.1R1, where the BGP add-path feature is enabled with 'send' option or with both 'send' and 'receive' options, a network-based attacker can cause the rpd daemon to crash and restart. Repeated crashes of the rpd daemon can result in an extended denial of service condition.
- CVE-2017-2301High
On Juniper Networks products running Junos OS versions prior to 11.4R13-S3, 12.1X46-D60, 12.3R12-S2, 13.2X51-D40, 13.3R10, 14.1R8, 14.1X53-D12, 14.1X55-D35, 14.2R7, 15.1F6, 15.1R3, 15.1X49-D60, and 15.1X53-D30, when DHCPv6 is enabled, receiving a crafted DHCPv6 packet causes the jdhcpd daemon to crash and restart. Repeated crashes of the jdhcpd process may lead to an extended denial of service condition for subscribers attempting to obtain IPv6 addresses.
- CVE-2017-2313High
Juniper Networks devices running affected versions of Junos OS may be vulnerable to a crafted BGP UPDATE which can lead to a crash and restart of the routing process daemon (rpd). Repeated crashes of the rpd daemon can result in an extended denial of service condition.
Original NVD description (English source)
An Improper Check for Unusual or Exceptional Conditions vulnerability in the Juniper DHCP service (jdhcpd) of Juniper Networks Junos OS and Junos OS Evolved allows a DHCP client in one subnet to exhaust the address pools of other subnets, leading to a Denial of Service (DoS) on the downstream DHCP server. By default, the DHCP relay agent inserts its own Option 82 information when forwarding client requests, optionally replacing any Option 82 information provided by the client. When a specific DHCP DISCOVER is received in 'forward-only' mode with Option 82, the device should drop the message unless 'trust-option82' is configured. Instead, the DHCP relay forwards these packets to the DHCP server unmodified, which uses up addresses in the DHCP server's address pool, ultimately leading to address pool exhaustion. This issue affects Junos OS: * all versions before 21.2R3-S10, * from 21.4 before 21.4R3-S12, * all versions of 22.2, * from 22.4 before 22.4R3-S8, * from