Juniper Networks Junos OS on MX Series contains an infinite loop vulnerability in the netsctp.ko kernel module that can be triggered by an unauthenticated network attacker sending crafted SCTP packets. The loop never exits, consuming CPU on the routing engine and eventually forcing the device into a denial‑of‑service state. The weakness is a classic Infinite Loop (CWE‑835).

The affected product is Junos OS on MX Series routers from Juniper Networks. Affects the following releases: 23.2R2‑S7.7, 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1, as well as all newer releases built on these lines. Specific respins are available for releases 23.2, 23.4, and 24.2.

The CVSS score of 8.7 indicates high severity. The EPSS score is <1%, suggesting a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, implying no confirmed widespread attacks yet. An attacker can remotely trigger the vulnerability by sending crafted SCTP traffic; no authentication is required. The exploit causes an infinite loop in the netsctp.ko kernel module, consuming CPU on the routing engine and ultimately bringing the device into a denial‑of‑service state. Because no workaround exists, remediation relies on applying the vendor patches or temporarily blocking SCTP traffic.