CVE-2026-57026 is an improper validation of syntactic correctness of input vulnerability (CWE-1286) in the SIP plugin of Juniper Networks Junos OS on MX Series with SPC3 and SRX Series devices. When SIP ALG is enabled, processing a malformed SIP invite packet causes the flowd process to crash and restart, leading to a denial-of-service condition. The vulnerability affects all versions before 23.2R2-S7, 23.4 versions before 23.4R2-S8, 24.2 versions before 24.2R2-S5, 24.4 versions before 24.4R2-S4, 25.2 versions before 25.2R2, and 25.4 versions before 25.4R1-S2.

An unauthenticated, network-based attacker can cause a denial-of-service by sending a malformed SIP invite packet to an affected device with SIP ALG enabled. This causes the flow processing daemon to crash and restart, resulting in a temporary service outage until the system recovers automatically. There is no impact on confidentiality or integrity reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability is fixed in Junos OS versions 23.2R2-S7 and later for 23.2 branch, 23.4R2-S8 and later for 23.4 branch, 24.2R2-S5 and later for 24.2 branch, 24.4R2-S4 and later for 24.4 branch, 25.2R2 and later for 25.2 branch, and 25.4R1-S2 and later for 25.4 branch. Until patched, consider disabling SIP ALG if feasible to mitigate exposure.