An unchecked input for loop condition vulnerability (CWE-606) exists in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS on MX Series devices. Specifically, Micro-BFD session flaps generate up/down events queued by PFEMAN. In Virtual-Chassis scenarios with locality-bias configured, processing these events takes significant time. Continuous session flapping causes event queues to grow, preventing PFEMAN from completing processing. This leads to the PFEMAN watchdog timer expiring, causing the FPC to crash and restart, resulting in a denial-of-service. The issue affects MX Series FPCs up to MPC9 and line cards LC2101/2103 and LC480, but not MPC10/11, LC4800/9600, or MX304. Affected Junos OS versions include all versions before 23.2R2-S7, 23.4 versions before 23.4R2-S8, 24.2 versions before 24.2R2-S4, 24.4 versions before 24.4R2-S3, and 25.2 versions before 25.2R2. Juniper manages remediation for this cloud-hosted service. No known exploits in the wild have been reported.

An unauthenticated, adjacent attacker can cause a denial-of-service by triggering continuous Micro-BFD session flaps that cause the PFEMAN event queue to grow indefinitely. This prevents PFEMAN from completing event processing, leading to the expiration of the watchdog timer, which causes the FPC to crash and restart. The result is a complete service outage on affected MX Series devices.

A patch is available for this vulnerability. Juniper Networks manages remediation for this cloud-hosted service; users should apply the fixed Junos OS versions: 23.2R2-S7 or later, 23.4R2-S8 or later, 24.2R2-S4 or later, 24.4R2-S3 or later, and 25.2R2 or later. Check the vendor advisory for the latest remediation guidance and apply updates accordingly.