Juniper Junos OS DHCP Relay Option 82 Handling Flaw Causes DoS (CVE-2025-59960)

Vulnerability Key Information Vulnerability ID: CVE-2025-59960 Affected Products: - All versions of Junos OS - All versions of Junos OS Evolved Severity: High CVSS Score: - CVSS v3.1: 7.4 - CVSS v4.0: 6.3 Description: - A vulnerability exists in the DHCP service (jdhcpd) of Juniper Networks Junos OS and Junos OS Evolved, where improper handling of abnormal or exceptional conditions allows a DHCP client in one subnet to exhaust the address pool of another subnet, leading to a Denial of Service (DoS) on downstream DHCP servers. - Specifically, the DHCP relay agent inserts its own Option 82 information when forwarding client requests, instead of replacing any Option 82 information provided by the client. When a specific DHCP DISCOVER message containing Option 82 is received in "forward-only" mode, the device should drop the message unless "trust-option82" is configured. However, in practice, the relay agent forwards these packets unchanged to the DHCP server, consuming the DHCP server’s address pool and eventually exhausting it. Affected Junos OS Versions: - All versions prior to 21.2R3-S10 - Versions between 21.4 and 21.4R3-S12 - All 22.2 versions prior to 22.4R3-S8 - Versions between 22.4 and 22.4R3-S8 - Versions between 23.2 and 23.2R2-S5 - Versions between 23.4 and 23.4R2-S6 - Versions between 24.2 and 24.2R2-S2 - Versions between 24.4 and 24.4R2 - All 25.2 versions prior to 25.2R1-S1 and 25.2R2 Affected Junos OS Evolved Versions: - All versions prior to 21.4R3-S12-EVO - 22.2-EVO version - Versions between 22.4 and 22.4R3-S8-EVO - Versions between 23.2 and 23.2R2-S5-EVO - Versions between 23.4 and 23.4R2-S6-EVO - Versions between 24.2 and 24.2R2-S2-EVO - Versions between 24.4 and 24.4R2-EVO - All 25.2 versions prior to 25.2R1-S1-EVO and 25.2R2-EVO Configuration Requirement: The DHCP relay must be configured in "forward-only" mode to be vulnerable to this issue. Solution: - Updated versions of Junos OS and Junos OS Evolved have been released to fix this specific issue. - The documentation provides a detailed list of affected versions and their corresponding fixed releases. Workaround: No known workaround is currently available.

Goal Reached Thanks to every supporter — we hit 100%!

Juniper Junos OS DHCP Relay Option 82 Handling Flaw Causes DoS (CVE-2025-59960)