Read the docs
TI-2020-01625 Aliases CVE-2020-1678GHSA-4w73-g2f7-3g9h

Junos OS and Junos OS Evolved: RPD can crash due to a slow memory leak.

Priority LOW 29CWE-400Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-400.

Summary

On Juniper Networks Junos OS and Junos OS Evolved platforms with EVPN configured, receipt of specific BGP packets causes a slow memory leak. If the memory is exhausted the rpd process might crash. If the issue occurs, the memory leak could be seen by executing the "show task memory detail | match policy | match evpn" command multiple times to check if memory (Alloc Blocks value) is increasing. root@device> show task memory detail | match policy | match evpn ------------------------ Allocator Memory Report ------------------------ Name | Size | Alloc DTXP Size | Alloc Blocks | Alloc Bytes | MaxAlloc Blocks | MaxAlloc Bytes Policy EVPN Params 20 24 3330678 79936272 3330678 79936272 root@device> show task memory detail | match policy | match evpn ------------------------ Allocator Memory Report ------------------------ Name | Size | Alloc DTXP Size | Alloc Blocks | Alloc Bytes | MaxAlloc Blocks | MaxAlloc Bytes Policy EVPN Params 20 24 36620255 878886120 36620255 878886120 This issue affects: Juniper Networks Junos OS 19.4 versions prior to 19.4R2; 20.1 versions prior to 20.1R1-S4, 20.1R2; Juniper Networks Junos OS Evolved: 19.4 versions; 20.1 versions prior to 20.1R1-S4-EVO, 20.1R2-EVO; 20.2 versions prior to 20.2R1-EVO; This issue does not affect: Juniper Networks Junos OS releases prior to 19.4R1. Juniper Networks Junos OS Evolved releases prior to 19.4R1-EVO.

Why it matters now

EPSS 0.00413 35th percentileScored 2026-11-07
Fix Fixed Junos OS (Juniper Networks): 19.4R2, 20.1R1-S4, 20.1R2Junos OS Evolved (Juniper Networks): 20.1R1-S4-EVO, 20.1R2-EVO

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
JuniperJunos OS19.4 to before 19.4R2; 20.1 to before 20.1R1-S4, 20.1R219.4R2, 20.1R1-S4, 20.1R2Patch availableCNA
JuniperJunos OS Evolved19.4-EVO; 20.1-EVO to before 20.1R1-S4-EVO, 20.1R2-EVO20.1R1-S4-EVO, 20.1R2-EVOPatch availableCNA
  • Junos OS VendorJuniper Affected 19.4 to before 19.4R2; 20.1 to before 20.1R1-S4, 20.1R2 Fixed in 19.4R2, 20.1R1-S4, 20.1R2 Patch available CNA
  • Junos OS Evolved VendorJuniper Affected 19.4-EVO; 20.1-EVO to before 20.1R1-S4-EVO, 20.1R2-EVO Fixed in 20.1R1-S4-EVO, 20.1R2-EVO Patch available CNA

CPE configurations NVD · 13

CPEVersionsRoleVendor
cpe:2.3:o:juniper:junos:19.4:r1:*:*:*:*:*:*19.4 r1VulnerableJuniper
cpe:2.3:o:juniper:junos:19.4:r1-s1:*:*:*:*:*:*19.4 r1-s1VulnerableJuniper
cpe:2.3:o:juniper:junos:19.4:r1-s2:*:*:*:*:*:*19.4 r1-s2VulnerableJuniper
cpe:2.3:o:juniper:junos:20.1:r1:*:*:*:*:*:*20.1 r1VulnerableJuniper
cpe:2.3:o:juniper:junos:20.1:r1-s1:*:*:*:*:*:*20.1 r1-s1VulnerableJuniper
cpe:2.3:o:juniper:junos:20.1:r1-s2:*:*:*:*:*:*20.1 r1-s2VulnerableJuniper
cpe:2.3:o:juniper:junos:20.1:r1-s3:*:*:*:*:*:*20.1 r1-s3VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:19.4:r1:*:*:*:*:*:*19.4 r1VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:19.4:r2:*:*:*:*:*:*19.4 r2VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:19.4:r2-s1:*:*:*:*:*:*19.4 r2-s1VulnerableJuniper
  • cpe:2.3:o:juniper:junos:19.4:r1:*:*:*:*:*:* Versions 19.4 r1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:19.4:r1-s1:*:*:*:*:*:* Versions 19.4 r1-s1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:19.4:r1-s2:*:*:*:*:*:* Versions 19.4 r1-s2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:20.1:r1:*:*:*:*:*:* Versions 20.1 r1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:20.1:r1-s1:*:*:*:*:*:* Versions 20.1 r1-s1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:20.1:r1-s2:*:*:*:*:*:* Versions 20.1 r1-s2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:20.1:r1-s3:*:*:*:*:*:* Versions 20.1 r1-s3 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:19.4:r1:*:*:*:*:*:* Versions 19.4 r1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:19.4:r2:*:*:*:*:*:* Versions 19.4 r2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:19.4:r2-s1:*:*:*:*:*:* Versions 19.4 r2-s1 Vulnerable ·Juniper
Show 3 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:juniper:junos_os_evolved:20.1:-:*:*:*:*:*:*20.1VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:20.1:r1:*:*:*:*:*:*20.1 r1VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:20.2:-:*:*:*:*:*:*20.2VulnerableJuniper
  • cpe:2.3:o:juniper:junos_os_evolved:20.1:-:*:*:*:*:*:* Versions 20.1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:20.1:r1:*:*:*:*:*:* Versions 20.1 r1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:20.2:-:*:*:*:*:*:* Versions 20.2 Vulnerable ·Juniper

Remediation

  • Fix · CNA Junos OS (Juniper Networks) Fixed in 19.4R2, 20.1R1-S4, 20.1R2
  • Fix · CNA Junos OS Evolved (Juniper Networks) Fixed in 20.1R1-S4-EVO, 20.1R2-EVO

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-1678
  2. 2026-10-03 Alias added: GHSA-4w73-g2f7-3g9h

References

  • TI-2023-18638 Junos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthenticated to… KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-01585 Out of Cycle Security Advisory: Junos OS: Security vulnerability in J-Web and web based (HTTP/HTTPS) services KEVCVSS 3.1CRITICAL 9.8
  • TI-2015-04610 Assertion failure in ISC BIND named via TKEY queries KEVCVSS 3.1HIGH 7.5
  • TI-2025-15550 Junos OS: An local attacker with shell access can execute arbitrary code KEVCVSS 4.0MEDIUM 6.7
  • TI-2023-18644 Junos OS: SRX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload and download arbitrary files KEVCVSS 3.1MEDIUM 5.3
  • TI-2023-18640 Junos OS: EX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload arbitrary files KEVCVSS 3.1MEDIUM 5.3
See all 792 →

Sources