Juniper Networks Junos OS on MX Series contains an infinite loop vulnerability in the netsctp.ko kernel module that can be triggered by an unauthenticated network attacker sending crafted SCTP packets. The loop never exits, consuming CPU on the routing engine and eventually forcing the device into a denial‑of‑service state. The weakness is a classic Infinite Loop (CWE‑835).

The affected product is Junos OS on MX Series routers from Juniper Networks. Affects the following releases: 23.2R2‑S7.7, 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1, as well as all newer releases built on these lines. Specific respins are available for releases 23.2, 23.4, and 24.2.

The CVSS score of 8.7 indicates high severity. The EPSS score is currently unavailable, so the precise exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation yet. An attacker can attack remotely over the network, requires no authentication, and only needs to send crafted SCTP traffic to trigger the infinite loop and cause a DoS on the routing engine. No workaround has been published, so mitigating the issue relies on applying the vendor patches or temporarily blocking SCTP traffic.