An integer underflow in the SRX packet forwarding engine allows an unauthenticated attacker to trigger a forwarding‑plane denial of service by sending a crafted ICMP message tied to an SVR carrier session. The flaw can cause the SRX device to become unresponsive for traffic forwarding. No other impact is indicated in the available description.

Affected are Juniper Networks Junos OS and Junos OS Evolved running on SRX Series devices. The vulnerability applies to all current releases listed in the vendor advisory, including 23.2R2‑S7.7, 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1 and all later Junos OS releases, as well as the corresponding Junos OS Evolved releases 23.2R2‑S7.7‑EVO, 23.4R2‑S8.11‑EVO, 24.2R2‑S5.6‑EVO, 24.4R2‑S5‑EVO, 25.2R2‑S2‑EVO, 25.2X100‑D35‑EVO, 25.4R1‑S3‑EVO, 25.4R2‑EVO, 25.4X300‑D40‑EVO, 26.2R1‑S2‑EVO, 26.2R2‑EVO, 26.4R1‑EVO and all subsequent releases.

The CVSS score of 7.1 indicates high severity, while the EPSS score of less than 1% suggests a very low probability of exploitation. The flaw is not listed in the CISA KEV catalog. Attackers must send a specially crafted ICMP packet to a device through an SVR carrier session; authentication is not required. The primary impact is on availability, as the forwarding plane can be suspended and the device may become unresponsive.