Junos OS and Junos OS Evolved: RPD can crash due to a slow memory leak.
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-400.
Summary
On Juniper Networks Junos OS and Junos OS Evolved platforms with EVPN configured, receipt of specific BGP packets causes a slow memory leak. If the memory is exhausted the rpd process might crash. If the issue occurs, the memory leak could be seen by executing the "show task memory detail | match policy | match evpn" command multiple times to check if memory (Alloc Blocks value) is increasing. root@device> show task memory detail | match policy | match evpn ------------------------ Allocator Memory Report ------------------------ Name | Size | Alloc DTXP Size | Alloc Blocks | Alloc Bytes | MaxAlloc Blocks | MaxAlloc Bytes Policy EVPN Params 20 24 3330678 79936272 3330678 79936272 root@device> show task memory detail | match policy | match evpn ------------------------ Allocator Memory Report ------------------------ Name | Size | Alloc DTXP Size | Alloc Blocks | Alloc Bytes | MaxAlloc Blocks | MaxAlloc Bytes Policy EVPN Params 20 24 36620255 878886120 36620255 878886120 This issue affects: Juniper Networks Junos OS 19.4 versions prior to 19.4R2; 20.1 versions prior to 20.1R1-S4, 20.1R2; Juniper Networks Junos OS Evolved: 19.4 versions; 20.1 versions prior to 20.1R1-S4-EVO, 20.1R2-EVO; 20.2 versions prior to 20.2R1-EVO; This issue does not affect: Juniper Networks Junos OS releases prior to 19.4R1. Juniper Networks Junos OS Evolved releases prior to 19.4R1-EVO.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Juniper | Junos OS | 19.4 to before 19.4R2; 20.1 to before 20.1R1-S4, 20.1R2 | 19.4R2, 20.1R1-S4, 20.1R2 | Patch available | CNA |
| Juniper | Junos OS Evolved | 19.4-EVO; 20.1-EVO to before 20.1R1-S4-EVO, 20.1R2-EVO | 20.1R1-S4-EVO, 20.1R2-EVO | Patch available | CNA |
- Junos OS VendorJuniper Affected 19.4 to before 19.4R2; 20.1 to before 20.1R1-S4, 20.1R2 Fixed in 19.4R2, 20.1R1-S4, 20.1R2 Patch available CNA
- Junos OS Evolved VendorJuniper Affected 19.4-EVO; 20.1-EVO to before 20.1R1-S4-EVO, 20.1R2-EVO Fixed in 20.1R1-S4-EVO, 20.1R2-EVO Patch available CNA
CPE configurations NVD · 13
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:juniper:junos:19.4:r1:*:*:*:*:*:* | 19.4 r1 | Vulnerable | Juniper |
| cpe:2.3:o:juniper:junos:19.4:r1-s1:*:*:*:*:*:* | 19.4 r1-s1 | Vulnerable | Juniper |
| cpe:2.3:o:juniper:junos:19.4:r1-s2:*:*:*:*:*:* | 19.4 r1-s2 | Vulnerable | Juniper |
| cpe:2.3:o:juniper:junos:20.1:r1:*:*:*:*:*:* | 20.1 r1 | Vulnerable | Juniper |
| cpe:2.3:o:juniper:junos:20.1:r1-s1:*:*:*:*:*:* | 20.1 r1-s1 | Vulnerable | Juniper |
| cpe:2.3:o:juniper:junos:20.1:r1-s2:*:*:*:*:*:* | 20.1 r1-s2 | Vulnerable | Juniper |
| cpe:2.3:o:juniper:junos:20.1:r1-s3:*:*:*:*:*:* | 20.1 r1-s3 | Vulnerable | Juniper |
| cpe:2.3:o:juniper:junos_os_evolved:19.4:r1:*:*:*:*:*:* | 19.4 r1 | Vulnerable | Juniper |
| cpe:2.3:o:juniper:junos_os_evolved:19.4:r2:*:*:*:*:*:* | 19.4 r2 | Vulnerable | Juniper |
| cpe:2.3:o:juniper:junos_os_evolved:19.4:r2-s1:*:*:*:*:*:* | 19.4 r2-s1 | Vulnerable | Juniper |
- cpe:2.3:o:juniper:junos:19.4:r1:*:*:*:*:*:* Versions 19.4 r1 Vulnerable ·Juniper
- cpe:2.3:o:juniper:junos:19.4:r1-s1:*:*:*:*:*:* Versions 19.4 r1-s1 Vulnerable ·Juniper
- cpe:2.3:o:juniper:junos:19.4:r1-s2:*:*:*:*:*:* Versions 19.4 r1-s2 Vulnerable ·Juniper
- cpe:2.3:o:juniper:junos:20.1:r1:*:*:*:*:*:* Versions 20.1 r1 Vulnerable ·Juniper
- cpe:2.3:o:juniper:junos:20.1:r1-s1:*:*:*:*:*:* Versions 20.1 r1-s1 Vulnerable ·Juniper
- cpe:2.3:o:juniper:junos:20.1:r1-s2:*:*:*:*:*:* Versions 20.1 r1-s2 Vulnerable ·Juniper
- cpe:2.3:o:juniper:junos:20.1:r1-s3:*:*:*:*:*:* Versions 20.1 r1-s3 Vulnerable ·Juniper
- cpe:2.3:o:juniper:junos_os_evolved:19.4:r1:*:*:*:*:*:* Versions 19.4 r1 Vulnerable ·Juniper
- cpe:2.3:o:juniper:junos_os_evolved:19.4:r2:*:*:*:*:*:* Versions 19.4 r2 Vulnerable ·Juniper
- cpe:2.3:o:juniper:junos_os_evolved:19.4:r2-s1:*:*:*:*:*:* Versions 19.4 r2-s1 Vulnerable ·Juniper
Remediation
- Fix · CNA Junos OS (Juniper Networks) Fixed in 19.4R2, 20.1R1-S4, 20.1R2
- Fix · CNA Junos OS Evolved (Juniper Networks) Fixed in 20.1R1-S4-EVO, 20.1R2-EVO
Timeline
- 2026-10-02 Threatist record created from CVE-2020-1678
- 2026-10-03 Alias added: GHSA-4w73-g2f7-3g9h
References
Advisory 1
More Juniper Junos vulnerabilities
- TI-2023-18638 Junos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthenticated to… KEVCVSS 3.1CRITICAL 9.8
- TI-2020-01585 Out of Cycle Security Advisory: Junos OS: Security vulnerability in J-Web and web based (HTTP/HTTPS) services KEVCVSS 3.1CRITICAL 9.8
- TI-2015-04610 Assertion failure in ISC BIND named via TKEY queries KEVCVSS 3.1HIGH 7.5
- TI-2025-15550 Junos OS: An local attacker with shell access can execute arbitrary code KEVCVSS 4.0MEDIUM 6.7
- TI-2023-18644 Junos OS: SRX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload and download arbitrary files KEVCVSS 3.1MEDIUM 5.3
- TI-2023-18640 Junos OS: EX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload arbitrary files KEVCVSS 3.1MEDIUM 5.3
Sources
- CVE-2020-1678 · CVE Program
- CVE-2020-1678 · NVD
- FIRST EPSS
- GHSA-4w73-g2f7-3g9h · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences