CVE-2026-21905VulnerabilityPublished 15 Jan 2026

CVE-2026-21905: Juniper Networks Junos OS · Infinite Loop

Affects Juniper Networks Junos OSSource CVE Database V5

Not known to be exploited · CVSS 7.5 High · fixed in 25.2R1-S1 : patch Juniper Networks Junos OS soon.

Data as of 26 Oct 2026, 06:26 UTC

CVSS 3.1 base score

7.5High

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.4% chance of exploitation in 30 days – higher than 34% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 25.2R1-S1, 24.4R2-S1, 24.2R2-S3 +5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: None: There is no loss of confidentiality within the impacted component.
Integrity: None: There is no loss of integrity within the impacted component.
Availability: High: There is total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed). Alternatively, the attacker has the ability to deny some availability, but the loss of availability presents a direct, serious consequence to the impacted component (e.g., the attacker cannot disrupt existing connections, but can prevent new connections; the attacker can repeatedly exploit a vulnerability that, in each instance of a successful attack, leaks a only small amount of memory, but after repeated exploitation causes a service to become completely unavailable).

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 15 Jan 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
Juniper NetworksJunos OS	Affected <21.2R3-S10 >=21.4 <21.4R3-S12 >=22.4 <22.4R3-S8 >=23.2 <23.2R2-S5 >=23.4 <23.4R2-S6 >=24.2 <24.2R2-S3 >=24.4 <24.4R2-S1 =25.2	Fixed in 25.2R1-S1 24.4R2-S1 24.2R2-S3 23.4R2-S6 23.2R2-S5 22.4R3-S8 21.4R3-S12 21.2R3-S10

AI-suggested

The primary mitigation is to apply the vendor-provided patches by upgrading affected Junos OS versions to the fixed releases listed: 21.2R3-S10 or later, 21.4R3-S12 or later, 22.4R3-S8 or later, 23.2R2-S5 or later, 23.4R2-S6 or later, 24.2R2-S3 or later, 24.4R2-S1 or later, and 25.2R1-S1/25.2R2 or later. Until patches can be applied, organizations should implement network-level controls to limit exposure. This includes filtering or rate-limiting SIP traffic over TCP at network perimeters and ingress points, especially from untrusted sources. Monitoring SIP traffic for abnormal patterns or excessive malformed messages can help detect exploitation attempts early. Disabling SIP ALG functionality on affected devices, if feasible without impacting business operations, can reduce attack surface. Employing intrusion detection/prevention systems (IDS/IPS) with signatures targeting malformed SIP TCP messages may provide additional protection. Regularly auditing device configurations and ensuring minimal exposure of management interfaces to untrusted networks is recommended. Finally, organizations should prepare incident response plans to quickly address potential DoS events caused by this vulnerability.

Description

CVE-2026-21905 is a high-severity vulnerability in Juniper Networks Junos OS affecting SRX Series and MX Series devices with MX-SPC3 or MS-MPC service cards. It involves an infinite loop triggered by malformed SIP messages over TCP, causing the flow management process to crash and resulting in a denial of service (DoS). The vulnerability requires no authentication or user interaction and affects multiple Junos OS versions prior to specific patched releases. SIP messages over UDP are not affected. Exploitation leads to a crash of critical processes (flowd or mspmand), disrupting network traffic handling. No known exploits are currently reported in the wild. European organizations relying on Juniper SRX or MX Series devices for network security and routing are at risk of service disruption. Mitigation requires timely patching to the fixed Junos OS versions. Network-level filtering of SIP TCP traffic and monitoring for anomalous SIP message patterns can reduce exposure. Countries with high adoption of Juniper infrastructure and critical telecom or enterprise networks are most likely impacted.

Impact

For European organizations, the impact of CVE-2026-21905 can be substantial, especially for those relying on Juniper SRX and MX Series devices for critical network security and routing functions. The denial of service caused by crashing flow management processes can lead to network outages, degraded performance, and loss of connectivity for enterprise and service provider networks. This disruption can affect business operations, critical communications, and service availability. Telecommunications providers using Juniper MX Series routers with affected service cards may experience service interruptions impacting large customer bases. Enterprises with SRX Series firewalls may face security gaps during downtime, increasing exposure to other threats. The vulnerability’s unauthenticated, network-based exploit vector means attackers can launch attacks remotely without prior access, increasing the risk of widespread disruption. Given the importance of these devices in network infrastructure, the potential for cascading effects on dependent services and applications is significant. Additionally, the inability to handle SIP traffic properly may affect VoIP and unified communications systems that rely on SIP, further impacting business communications.

Summary

CVE-2026-21905 is a vulnerability classified under CWE-835 (Loop with Unreachable Exit Condition) found in the SIP application layer gateway (ALG) component of Juniper Networks Junos OS running on SRX Series and MX Series routers equipped with MX-SPC3 or MS-MPC service cards. The flaw arises when the device receives multiple SIP messages over TCP; the SIP headers are parsed incorrectly, causing the processing loop to become infinite. This infinite loop leads to the expiration of a watchdog timer, which in turn crashes the flow management process—specifically, the flowd process on SRX Series and MX Series with MX-SPC3 cards, or the mspmand process on MX Series with MS-MPC cards. The crash results in a denial of service (DoS) condition, disrupting the device's ability to manage network flows. The vulnerability is exploitable remotely without authentication or user interaction, making it accessible to unauthenticated network-based attackers who can send crafted SIP messages over TCP. Notably, SIP messages over UDP do not trigger this issue. The affected Junos OS versions span multiple releases before the patched versions 21.2R3-S10, 21.4R3-S12, 22.4R3-S8, 23.2R2-S5, 23.4R2-S6, 24.2R2-S3, 24.4R2-S1, and 25.2R1-S1/25.2R2. Although no known exploits are reported in the wild, the vulnerability's characteristics and ease of exploitation make it a significant risk for network availability. The root cause is improper SIP header parsing leading to an infinite loop, a classic denial of service vector in network protocol handling components.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 22 Jan 2026, 21:26 UTC

WeaknessesCWE-835

Technical details

References

Community reviews

Related threats