CVE-2026-21905: Juniper Junos SIP ALG DoS Vulnerability

CVE-2026-21905 Overview

CVE-2026-21905 is a Denial of Service (DoS) vulnerability in the Session Initiation Protocol (SIP) Application Layer Gateway (ALG) of Juniper Networks Junos OS. The flaw affects SRX Series firewalls and MX Series routers equipped with MX-SPC3 or MS-MPC service cards. An unauthenticated, network-based attacker can send specifically crafted SIP messages over TCP to trigger an infinite loop in the SIP header parser. The condition causes a watchdog timer expiration, crashing the flowd process on SRX Series and MX Series with MX-SPC3, or the mspmand process on MX Series with MS-MPC. The vulnerability is tracked under [CWE-835] and only manifests over TCP transport.

Critical Impact
Unauthenticated remote attackers can crash flow management processes on affected Juniper devices, disrupting traffic forwarding and security enforcement.

Affected Products

Juniper Junos OS on SRX Series (SRX300, SRX320, SRX340, SRX345, SRX380, SRX1500, SRX1600, SRX2300, SRX4100, SRX4120, SRX4200, SRX4300, SRX4600, SRX4700, SRX5400, SRX5600, SRX5800)
Juniper Junos OS on MX Series with MX-SPC3 or MS-MPC service cards (MX204, MX240, MX304, MX480, MX960, MX2008, MX2010, MX2020, MX10004, MX10008)
Junos OS versions before 21.2R3-S10, 21.4R3-S12, 22.4R3-S8, 23.2R2-S5, 23.4R2-S6, 24.2R2-S3, 24.4R2-S1, 25.2R1-S1, and 25.2R2

Discovery Timeline

2026-01-15 - CVE-2026-21905 published to NVD
2026-01-23 - Last updated in NVD database

Technical Details for CVE-2026-21905

Vulnerability Analysis

The vulnerability resides in the SIP ALG component responsible for inspecting and tracking SIP signaling traffic traversing the firewall or router. SIP ALG functionality enables dynamic pinhole creation for media streams and Network Address Translation (NAT) for SIP headers. When the ALG receives multiple SIP messages over TCP, the parser handles SIP headers incorrectly, entering a state from which no exit condition is reachable.

The resulting infinite loop consumes the worker thread until the watchdog timer expires. On SRX Series and MX Series with MX-SPC3, the watchdog terminates the flowd process, which is responsible for flow-based packet forwarding and stateful security processing. On MX Series with MS-MPC, the mspmand process is killed instead. A crash of either process disrupts traffic forwarding through the affected services plane until the process restarts.

Root Cause

The root cause is a Loop with Unreachable Exit Condition [CWE-835] in the SIP header parsing logic. The parser fails to advance correctly through certain sequences of TCP-segmented SIP messages, leaving the loop control variable in a state that never satisfies the termination condition. SIP messages sent over UDP do not trigger the condition because the TCP-specific parsing path is bypassed.

Attack Vector

Exploitation requires no authentication and no user interaction. An attacker sends crafted SIP signaling messages over TCP to an interface where SIP ALG inspection is enabled. Because SIP ALG is commonly applied to traffic transiting the device rather than terminating on it, attackers can target the vulnerability through SIP traffic destined for internal endpoints. Repeated triggering can result in sustained denial of service as the process repeatedly crashes and restarts.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Juniper Security Advisory JSA106004 for vendor-supplied technical context.

Detection Methods for CVE-2026-21905

Indicators of Compromise

Unexpected restarts of the flowd process on SRX Series or MX Series with MX-SPC3 service cards
Unexpected restarts of the mspmand process on MX Series with MS-MPC service cards
Core files generated under /var/crash/ referencing flowd or mspmand
Loss of flow state and transient traffic forwarding failures correlated with inbound SIP/TCP traffic

Detection Strategies

Monitor Junos system logs for flowd or mspmand daemon crash and restart messages, including watchdog timeout events
Inspect SIP signaling traffic over TCP (default port 5060) for malformed headers or anomalous message sequences
Correlate ALG statistics from show security alg sip with process restart events to identify trigger patterns

Monitoring Recommendations

Forward Junos syslog and chassis events to a centralized Security Information and Event Management (SIEM) platform for correlation
Establish baseline metrics for SIP ALG sessions and alert on sudden spikes in TCP-based SIP signaling
Track service card health and flow process uptime using SNMP or streaming telemetry

How to Mitigate CVE-2026-21905

Immediate Actions Required

Upgrade Junos OS to a fixed release: 21.2R3-S10, 21.4R3-S12, 22.4R3-S8, 23.2R2-S5, 23.4R2-S6, 24.2R2-S3, 24.4R2-S1, 25.2R1-S1, 25.2R2, or later
If patching cannot be performed immediately, disable SIP ALG on affected devices where SIP inspection is not required
Restrict TCP-based SIP traffic at network ingress points using stateless filters or access control lists

Patch Information

Juniper Networks has released fixed software in the versions listed above. Consult the Juniper Security Advisory JSA106004 and the Juniper Support Portal advisory for full version mapping, download links, and upgrade guidance specific to each platform.

Workarounds

Disable SIP ALG using the Junos configuration command set security alg sip disable when SIP inspection is not operationally required
Use firewall filters to block or rate-limit untrusted SIP/TCP traffic destined for or transiting the affected device
Where SIP is required, prefer UDP transport since the vulnerability cannot be triggered over UDP

bash

# Disable SIP ALG on Junos OS as a temporary workaround
configure
set security alg sip disable
commit and-quit

# Verify SIP ALG status
show security alg status | match sip