CVSS: v3.1: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)CVSS: v4.0: 9.2 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/AU:Y/R:A/V:C/RE:M/U:Green)
A Use of Uninitialized Resource vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on SRX4700 devices allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS).When forwarding-options sampling is enabled, receipt of any traffic destined to the Routing Engine (RE) by the PFE line card leads to an FPC crash and restart, resulting in a Denial of Service (DoS) attack.Continued receipt and processing of any traffic leading to the RE by the PFE line card will create a sustained Denial of Service (DoS) condition to the PFE line card.
This issue affects Junos OS on SRX4700:
Below is the configuration to check if sampling is enabled.
[ forwarding-options sampling ]
Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
This issue was seen during production usage.
The following software releases have been updated to resolve this specific issue:Junos OS: 24.4R1-S3, 24.4R2, 25.2R1 and all subsequent releases.
This issue is being tracked as 1867583 which is visible on the Customer Support website.
Note: Juniper SIRT's policy is not to evaluate releases which are beyond End of Engineering (EOE) or End of Life (EOL).
To workaround this issue an administrator must block all traffic from the PFE line card to the Routing Engine (RE) until a fix can be taken.Even while under a persistent DoS attack the RE will continue to be accessible to administrators through non-PFE line card interfaces E.g. Console, FXP0.
2025-10-08: Initial Publication