A vulnerability in the SIP application layer gateway of Juniper Junos OS allows an unauthenticated, network‑based attacker to send specially crafted SIP messages over TCP that cause the SIP ALG to enter an infinite loop, resulting in a crash of the flowd or mspmand process and disabling the device’s ability to route traffic. This denial of service can interrupt critical services that rely on SRX or MX routers and is triggered by malformed SIP headers that are repeatedly parsed until a watchdog timer forces a restart.

The flaw affects Juniper Networks Junos OS running on SRX Series and MX Series routers equipped with MX‑SPC3 or MS‑MPC service cards. All releases prior to the specific patch milestones—21.2R3‑S10, 21.4R3‑S12, 22.4R3‑S8, 23.2R2‑S5, 23.4R2‑S6, 24.2R2‑S3, 24.4R2‑S1, 25.2R1‑S1, and 25.2R2—are vulnerable.

The CVSS score of 8.7 signals a high‑severity attack, yet the EPSS score of less than 1% indicates that mature, automated exploitation is unlikely at present. The vulnerability is not present in the CISA KEV catalog, suggesting no confirmed exploitation in the wild. Nevertheless, its vulnerability can be leveraged by any unauthenticated actor on the network able to transmit TCP SIP traffic, potentially causing widespread outages in environments that rely on these routing platforms.