An improperly managed lock in the GTP plugin of Juniper Networks Junos OS on SRX Series allows an unauthenticated network attacker to send a specially crafted GTP Modify Bearer Request message that acquires a lock and never releases it. The resulting deadlock blocks other threads, triggers a watchdog timeout, and causes an FPC crash and automatic restart. The crash produces a complete traffic outage until the device recovers. This is a denial‑of‑service vulnerability (CWE‑667).

Affected systems include Juniper Networks Junos OS on SRX Series routers. Vulnerable versions are all releases before 22.4R3‑S8, before 23.2R2‑S5, before 23.4R2‑S6, before 24.2R2‑S3, before 24.4R2‑S2, before 25.2R1‑S1, and before 25.2R2. All subsequent releases listed in the vendor patch guide include the fix.

The CVSS score is 8.7, indicating high severity, but the EPSS score is below 1 %, suggesting a low probability of exploitation. The vulnerability is remote, unauthenticated, and network‑based; the attacker must be able to send GTP packets to the SRX device. No workaround is available, so the only mitigation is to upgrade to a patched release. The risk to operations is significant due to full traffic disruption after a crash, but the actual risk of exploitation is low unless an attacker can target the device directly.