EUVD-2026-42714
GHSA-q2w6-r35r-2hxj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:X/RE:M/U:X
Unauthenticated network-reachable malformed packet (AV:N/AC:L/PR:N/UI:N) crashes flowd for an availability-only impact (A:H); no confidentiality or integrity effect and no scope change.
Primary rating from Vendor (juniper).
CVSS VectorVendor: juniper
Lifecycle Timeline
6DescriptionCVE.org
An Improper Validation of Syntactic Correctness of Input vulnerability in the SIP plugin of Juniper Networks Junos OS on MX Series with SPC3 and SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).If the SIP ALG is enabled on an affected device, the processing of a malformed SIP invite packet will cause a flow processing daemon (flowd) crash and restart. This leads to a complete service outage until the system has automatically recovered.
This issue affects Junos OS on MX Series with SPC3 and SRX Series:
- all versions before 23.2R2-S7,
- 23.4 versions before 23.4R2-S8,
- 24.2 versions before 24.2R2-S5,
- 24.4 versions before 24.4R2-S4,
- 25.2 versions before 25.2R2,
- 25.4 versions before 25.4R1-S2.
Articles & Coverage 2
AnalysisAI
Denial-of-service in Juniper Networks Junos OS on MX Series (with SPC3) and SRX Series devices allows an unauthenticated, network-based attacker to crash the flow processing daemon (flowd) by sending a malformed SIP INVITE packet when the SIP Application Layer Gateway (ALG) is enabled. The crash forces a flowd restart, producing a complete traffic-forwarding outage until the device auto-recovers, and can be repeated to sustain the outage. No public exploit identified at time of analysis; not listed in CISA KEV, and no EPSS score was provided.
Technical ContextAI
The flaw lives in the SIP ALG, a stateful helper within Junos flowd that inspects and rewrites Session Initiation Protocol (SIP, RFC 3261) signaling to dynamically pin-hole media flows for VoIP traffic. The root cause is classified as CWE-1286, Improper Validation of Syntactic Correctness of Input: the SIP parser fails to reject a syntactically malformed INVITE request before acting on it, leading to a fatal fault in flowd, the central daemon that performs packet forwarding, session management, and security services on SRX firewalls and MX line cards equipped with the SPC3 services processing card. Because flowd handles all data-plane flows, its crash is not confined to SIP traffic but interrupts all forwarding until the daemon restarts. The single generic CPE (cpe:2.3:a:juniper_networks:junos_os) does not encode the affected version ranges, so the authoritative affected list comes from the vendor advisory rather than the CPE string.
RemediationAI
Upgrade to a fixed Junos OS release for your train: 23.2R2-S7, 23.4R2-S8, 24.2R2-S5, 24.4R2-S4, 25.2R2, or 25.4R1-S2 (or later), as documented in Juniper advisory JSA110086 (https://supportportal.juniper.net/JSA110086) - Vendor-released patches confirmed per that advisory. Where immediate patching is not possible, the most effective compensating control is to disable the SIP ALG if it is not operationally required, since the vulnerability cannot be triggered without it; the trade-off is that VoIP/SIP flows relying on dynamic pin-holing may break and require static policies or alternative traversal. If SIP ALG must remain enabled, restrict which sources can reach the SIP signaling path by applying firewall filters/security policies that permit SIP (UDP/TCP 5060, and 5061 for TLS) only from trusted SIP trunk peers or known endpoints, and drop it from untrusted networks; the trade-off is added policy maintenance and the risk of blocking legitimate roaming endpoints. Monitor for flowd restarts as an indicator of attempted exploitation.
Remote denial of service in Juniper Networks Junos OS on MX Series (with SPC3) and SRX Series firewalls lets an unauthen
Privilege escalation in Juniper Networks Junos OS allows high-privileged local attackers to gain root access on Linux-ba
Denial-of-service in the Packet Forwarding Engine (PFE) of Juniper Junos OS on MX (with SPC3) and SRX-series firewalls l
Denial-of-service in Juniper Networks Junos OS on SRX Series devices lets an unauthenticated, network-based attacker exh
Denial-of-service in Juniper Networks Junos OS on EX Series switches (EX2300, EX3400, EX4000, EX4100, EX4400) lets a low
Denial-of-service in Juniper Junos OS on EX4100 and EX4400 Series switches allows an unauthenticated adjacent attacker t
Denial-of-service in Juniper Networks Junos OS on QFX10000 Series switches allows an unauthenticated, adjacent (Layer 2)
Denial-of-service in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series routers lets an unauth
Out-of-bounds write in the Juniper Networks Junos OS http-gatekeeper (http-gk) process on SRX Series firewalls crashes t
Repeated IKE negotiation failures on Juniper Junos OS (MX with SPC3 and SRX Series) cause a peer index rollover that ass
Web filtering bypass on Juniper Networks Junos OS MX Series exposes downstream resources to unauthenticated network atta
Denial-of-service in Juniper Networks Junos OS and Junos OS Evolved on EX Series, QFX Series, and MX Series allows a loc
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today