What is CVE-2025-21595?

CVE-2025-21595 is a medium-severity vulnerability in Juniper Junos, classified under Missing Release of Memory after Effective Lifetime. CVSS score: 6.5/10. Published 2025-04-09.

How severe is CVE-2025-21595?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Vulnerability in Juniper Junos

CVE-2025-21595

A Missing Release of Memory after Effective Lifetime vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated attacker to cause an FPC to crash, leading to De…

EPSS: 0.002 (13.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Affected products

Juniper Junos — versions 21.2, 21.4, 22.2
Juniper Junos_os_evolved — versions 21.2, 21.4, 22.2
Juniper Networks Junos Os — versions 0, 21.4, 22.2
Juniper Networks Junos Os Evolved — versions 0, 21.4-EVO, 22.2-EVO

Weakness classification (CWE)

CWE-401 — Missing Release of Memory after Effective Lifetime

References

sirt@juniper.net (vendor-advisory, Vendor Advisory)

Frequently asked questions

What is CVE-2025-21595?: CVE-2025-21595 is a medium-severity vulnerability in Juniper Junos, classified under Missing Release of Memory after Effective Lifetime. CVSS score: 6.5/10. Published 2025-04-09.
How severe is CVE-2025-21595?: Medium severity. CVSS v3 base score is 6.5 out of 10.