Product:
Junos OS
Summary
A Loop with Unreachable Exit Condition vulnerability in the SIP application layer gateway of Junos OS on SRX Series and MX Series with specific service cards allows an unauthenticated network-based attacker to crash the flow management process. This leads to a Denial of Service condition when specific SIP messages are sent over TCP. The issue does not occur with SIP messages sent over UDP.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.7 | CVE-2026-21905 |
Exploitation
To exploit this vulnerability, an attacker can send multiple specific SIP messages over TCP to the affected devices. This causes the SIP headers to be parsed incorrectly, resulting in a continuous loop that eventually crashes the flow management process. The attacker does not need any privileges or user interaction to trigger this vulnerability.
Affected Products
- Junos OS on SRX Series and MX Series with MX-SPC3 or MS-MPC service cards, all versions before 21.2R3-S10
- Junos OS from version 21.4 before 21.4R3-S12
- Junos OS from version 22.4 before 22.4R3-S8
- Junos OS from version 23.2 before 23.2R2-S5
- Junos OS from version 23.4 before 23.4R2-S6
- Junos OS from version 24.2 before 24.2R2-S3
- Junos OS from version 24.4 before 24.4R2-S1
- Junos OS from version 25.2 before 25.2R1-S1
Mitigation
To mitigate this vulnerability, it is recommended to upgrade to the latest versions of Junos OS that are not affected by this issue. Additionally, network administrators should implement measures to filter or restrict SIP messages over TCP to prevent potential exploitation.