Answer in brief
CVE-2026-33801 records a Medium severity (CVSS 6.5) vulnerability in Junos OS and Junos OS Evolved: When a specifically malformed BGP route update is received RPD crashes. The current sources do not mark it as known exploited. The current feed maps Juniper Networks/Junos OS (generic), Juniper Networks/Junos OS Evolved (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Juniper Networks/Junos OS (generic), Juniper Networks/Junos OS Evolved (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Juniper Networks/Junos OSgeneric | >=25.2 <25.2R2 | 25.2R2 |
| Juniper Networks/Junos OS Evolvedgeneric | >=25.2 <25.2R2-EVO | 25.2R2-EVO |
Published upstream
Jul 9, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Jul 13, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 10, 2026
An Improper Check for Unusual or Exceptional Conditions vulnerability in the routing protocol daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated attacker sending a specific BGP update over an established BGP session to cause a Denial-of-Service (DoS). Upon receipt of a specifically malformed non-inet/inet6 unicast BGP update, an RPD crash and restart is triggered, which will cause a complete service outage until routing has reconverged. The rpd crash occurs before the update can be readvertised, so there is no downstream propagation. This issue affects: * Junos OS versions 25.2 before 25.2R2; * Junos OS Evolved versions 25.2 before 25.2R2-EVO. This issue doesn't affect Junos OS versions before 25.2R1 nor Junos OS Evolved versions before 25.2R1-EVO.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-33801 records a Medium severity (CVSS 6.5) vulnerability in Junos OS and Junos OS Evolved: When a specifically malformed BGP route update is received RPD crashes. The current sources do not mark it as known exploited. The current feed maps Juniper Networks/Junos OS (generic), Juniper Networks/Junos OS Evolved (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Juniper Networks/Junos OS (generic), Juniper Networks/Junos OS Evolved (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Juniper Networks/Junos OSgeneric | >=25.2 <25.2R2 | 25.2R2 |
| Juniper Networks/Junos OS Evolvedgeneric | >=25.2 <25.2R2-EVO | 25.2R2-EVO |
Published upstream
Jul 9, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Jul 13, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 10, 2026
An Improper Check for Unusual or Exceptional Conditions vulnerability in the routing protocol daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated attacker sending a specific BGP update over an established BGP session to cause a Denial-of-Service (DoS). Upon receipt of a specifically malformed non-inet/inet6 unicast BGP update, an RPD crash and restart is triggered, which will cause a complete service outage until routing has reconverged. The rpd crash occurs before the update can be readvertised, so there is no downstream propagation. This issue affects: * Junos OS versions 25.2 before 25.2R2; * Junos OS Evolved versions 25.2 before 25.2R2-EVO. This issue doesn't affect Junos OS versions before 25.2R1 nor Junos OS Evolved versions before 25.2R1-EVO.
Quoted source text, attributed separately from HOL analysis.