Junos OS: SRX Series, MX Series with MX-SPC3 or MS-MPC: Receipt of multiple specific SIP messages results in flow management process crash

Summary

A Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the SIP application layer gateway (ALG) of Juniper Networks Junos OS on SRX Series and MX Series with MX-SPC3 or MS-MPC allows an unauthenticated network-based attacker sending specific SIP messages over TCP to crash the flow management process, leading to a Denial of Service (DoS). On SRX Series, and MX Series with MX-SPC3 or MS-MPC service cards, receipt of multiple SIP messages causes the SIP headers to be parsed incorrectly, eventually causing a continuous loop and leading to a watchdog timer expiration, crashing the flowd process on SRX Series and MX Series with MX-SPC3, or mspmand process on MX Series with MS-MPC. This issue only occurs over TCP. SIP messages sent over UDP cannot trigger this issue. This issue affects Junos OS on SRX Series and MX Series with MX-SPC3 and MS-MPC: • all versions before 21.2R3-S10,  • from 21.4 before 21.4R3-S12,  • from 22.4 before 22.4R3-S8,  • from 23.2 before 23.2R2-S5,  • from 23.4 before 23.4R2-S6,  • from 24.2 before 24.2R2-S3,  • from 24.4 before 24.4R2-S1,  • from 25.2 before 25.2R1-S1, 25.2R2.

Timeline

1. Jan 15, 2026, 8:19 PM UTCCVE published
2. Jan 16, 2026, 4:25 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: yes · Technical impact: partial

3. Jan 16, 2026, 4:26 PM UTCRecord last updated

Affected versions

• Juniper Networks Junos OS

  fixed in 21.2R3-S10; From 21.4 · fixed in 21.4R3-S12; From 22.4 · fixed in 22.4R3-S8; From 23.2 · fixed in 23.2R2-S5; From 23.4 · fixed in 23.4R2-S6; From 24.2 · fixed in 24.2R2-S3; From 24.4 · fixed in 24.4R2-S1

References 2