What is CVE-2024-21596?

CVE-2024-21596 is a medium-severity vulnerability in Juniper Junos, classified under Heap-based Buffer Overflow. CVSS score: 5.3/10. Published 2024-01-12.

How severe is CVE-2024-21596?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Buffer overflow in Juniper Junos

CVE-2024-21596

A Heap-based Buffer Overflow vulnerability in the Routing Protocol Daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network based attacker to cause a Denial of Service (DoS). If an attacker sends a specific BGP UPDATE message to the device, this will cause a memory overwrite and therefore an RPD crash and restart in the backup Routing Engine (RE). Continued receipt of these packets will cause a sustained Denial of Service (DoS) condition in the backup RE. The primary RE is not impacted by this issue and there is no impact on traffic. This issue only affects devices with NSR enabled. Note: NSR is not supported on the SRX Series and is therefore not affected by this vulnerability. This issue requires an attacker to have an established BGP session to a system affected by the issue. This issue affects both eBGP and iBGP implementations. This issue affects: Juniper Networks Junos OS * All versions earlier than 20.4R3-S9; * 21.2 versions earlier than 21.2R3-S7; * 21.3 versions earlier than 21.3R3-S5; * 21.4 versions earlier than 21.4R3-S5; * 22.1 versions earlier than 22.1R3-S4; * 22.2 versions earlier than 22.2R3-S2; * 22.3 versions earlier than 22.3R3-S1; * 22.4 versions earlier than 22.4R2-S2, 22.4R3; * 23.1 versions earlier than 23.1R2; * 23.2 versions earlier than 23.2R1-S2, 23.2R2. Juniper Networks Junos OS Evolved * All versions earlier than 21.3R3-S5-EVO; * 21.4-EVO versions earlier than 21.4R3-S5-EVO; * 22.1-EVO versions earlier than 22.1R3-S4-EVO; * 22.2-EVO versions earlier than 22.2R3-S2-EVO; * 22.3-EVO versions later than 22.3R1-EVO; * 22.4-EVO versions earlier than 22.4R2-S2-EVO, 22.4R3-EVO; * 23.1-EVO versions earlier than 23.1R2-EVO; * 23.2-EVO versions earlier than 23.2R1-S2-EVO, 23.2R2-EVO.

Vulnerability class: Buffer Overflow

Published 2024-01-12 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.

EPSS exploit prediction

EPSS: 0.005 (43.3th percentile), scored 2026-09-29.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 43rd percentile — 43.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: 0.000

Affected products

Juniper Junos — versions 20.4, 21.2, 21.3
Juniper Junos OS Evolved — versions 21.3, 21.4, 22.1
Juniper Networks Junos OS — versions 0, 21.2, 21.3
Juniper Networks Junos OS Evolved — versions 0, 21.4-EVO, 22.1-EVO

Weakness classification (CWE)

References

supportportal.juniper.net/JSA75735 (vendor-advisory, Vendor Advisory)
www.first.org/cvss/calculator/4.0 (technical-description, Vendor Advisory)

Frequently asked questions

What is CVE-2024-21596?: CVE-2024-21596 is a medium-severity vulnerability in Juniper Junos, classified under Heap-based Buffer Overflow. CVSS score: 5.3/10. Published 2024-01-12.
How severe is CVE-2024-21596?: Medium severity. CVSS v3 base score is 5.3 out of 10.