This vulnerability (CVE-2026-33797) in Juniper Networks Junos OS and Junos OS Evolved involves improper input validation (CWE-20) of BGP packets. An unauthenticated attacker with adjacency can send a crafted genuine BGP packet in an already established BGP session to forcibly reset that session, resulting in a denial of service. The issue affects Junos OS and Junos OS Evolved 25.2 versions prior to 25.2R2 and 25.2R2-EVO respectively. Both eBGP and iBGP sessions, over IPv4 and IPv6, are vulnerable. The vulnerability does not affect versions before 25.2R1 or 25.2R1-EVO. The CVSS v3.1 base score is 7.4, indicating high severity, with attack vector adjacent network, low attack complexity, no privileges required, no user interaction, and impact limited to availability (session reset causing DoS). No vendor advisory or patch information is currently available.

An unauthenticated adjacent attacker can cause a denial of service by resetting specific BGP sessions on affected Junos OS and Junos OS Evolved versions. This can disrupt network routing by forcing BGP session resets repeatedly, sustaining the denial of service condition. There is no impact on confidentiality or integrity according to the CVSS vector. The vulnerability affects both IPv4 and IPv6 BGP sessions, including eBGP and iBGP.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, network administrators should consider limiting adjacency to trusted peers and monitoring BGP session stability. No official remediation or temporary fix is currently documented by the vendor.