CVE-2026-21905 Overview
CVE-2026-21905 is a Loop with Unreachable Exit Condition (Infinite Loop) vulnerability affecting the SIP (Session Initiation Protocol) application layer gateway (ALG) in Juniper Networks Junos OS. This vulnerability exists on SRX Series firewalls and MX Series routers equipped with MX-SPC3 or MS-MPC service cards. An unauthenticated network-based attacker can exploit this flaw by sending specially crafted SIP messages over TCP, causing the flow management process to crash and resulting in a Denial of Service (DoS) condition.
Critical Impact
Unauthenticated attackers can remotely crash critical network infrastructure components (flowd or mspmand processes) by sending malformed SIP messages over TCP, potentially disrupting network services and communications.
Affected Products
- Juniper Networks Junos OS on SRX Series (all versions before 21.2R3-S10)
- Juniper Networks Junos OS on MX Series with MX-SPC3 or MS-MPC service cards
- Affected versions include: 21.4 before 21.4R3-S12, 22.4 before 22.4R3-S8, 23.2 before 23.2R2-S5, 23.4 before 23.4R2-S6, 24.2 before 24.2R2-S3, 24.4 before 24.4R2-S1, and 25.2 before 25.2R1-S1 or 25.2R2
Discovery Timeline
- 2026-01-15 - CVE-2026-21905 published to NVD
- 2026-01-16 - Last updated in NVD database
Technical Details for CVE-2026-21905
Vulnerability Analysis
This vulnerability is classified as CWE-835 (Loop with Unreachable Exit Condition), commonly known as an infinite loop vulnerability. The flaw resides within the SIP application layer gateway component of Junos OS, which is responsible for inspecting and processing SIP traffic traversing the network device.
When multiple SIP messages are received over TCP, the SIP header parsing logic encounters a condition where it incorrectly processes the headers. This malformed processing leads to a continuous loop within the code that cannot terminate normally. The infinite loop eventually triggers a watchdog timer expiration, which is a safety mechanism designed to detect hung processes.
On SRX Series devices and MX Series routers with MX-SPC3 service cards, the flowd process (flow daemon responsible for packet forwarding and session management) crashes. On MX Series routers with MS-MPC service cards, the mspmand process (multiservices PIC management daemon) is affected instead.
Importantly, this vulnerability can only be triggered via SIP messages sent over TCP. SIP communications using UDP are not affected by this issue, as the vulnerable code path is specific to TCP-based SIP processing.
Root Cause
The root cause of this vulnerability lies in improper handling of SIP header parsing when processing multiple SIP messages received over a TCP connection. The parsing logic enters a state where the exit condition for a processing loop becomes unreachable, causing the loop to execute indefinitely. This design flaw in the SIP ALG component fails to properly validate or limit iterations during header processing, ultimately exhausting resources and triggering the watchdog mechanism.
Attack Vector
The attack vector for CVE-2026-21905 is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:
- Establishing a TCP connection to a vulnerable Juniper device where SIP ALG is enabled
- Sending a sequence of specifically crafted SIP messages designed to trigger the parsing error
- The malformed SIP headers cause the parser to enter an infinite loop
- The watchdog timer detects the hung process and terminates it
- The flowd or mspmand process crash results in service disruption
The vulnerability mechanism involves the SIP ALG's header parsing routine failing to properly handle edge cases in SIP message formatting. When multiple malformed messages are received over a single TCP session, the cumulative effect causes the parser state machine to become stuck in an unrecoverable loop. Technical details and proof-of-concept information should be referenced from the Juniper Security Advisory JSA106004.
Detection Methods for CVE-2026-21905
Indicators of Compromise
- Unexpected crashes or restarts of the flowd process on SRX Series or MX Series with MX-SPC3
- Unexpected crashes or restarts of the mspmand process on MX Series with MS-MPC
- Watchdog timer expiration events in system logs
- High volume of SIP traffic over TCP from unusual sources
- Service disruptions coinciding with SIP message processing
Detection Strategies
- Monitor system logs for flowd or mspmand process crashes and watchdog timer expirations
- Implement network-based intrusion detection rules to identify abnormal SIP traffic patterns over TCP
- Use SentinelOne Singularity to monitor for process instability and anomalous network behavior on network infrastructure
- Configure alerts for repeated service restarts on SRX and MX series devices
Monitoring Recommendations
- Enable detailed logging for SIP ALG processing events
- Implement traffic analysis to detect unusual TCP-based SIP message volumes
- Monitor CPU utilization spikes that may indicate infinite loop conditions
- Set up SNMP traps or syslog alerts for critical process failures
- Review network flow data for suspicious patterns targeting SIP services
How to Mitigate CVE-2026-21905
Immediate Actions Required
- Upgrade to a fixed version of Junos OS as specified in the advisory: 21.2R3-S10, 21.4R3-S12, 22.4R3-S8, 23.2R2-S5, 23.4R2-S6, 24.2R2-S3, 24.4R2-S1, 25.2R1-S1, or 25.2R2
- If immediate patching is not possible, consider disabling SIP ALG if not required for business operations
- Implement access control lists to restrict SIP traffic from untrusted sources
- Monitor affected devices for signs of exploitation while planning upgrade windows
Patch Information
Juniper Networks has released patched versions of Junos OS to address this vulnerability. Organizations should upgrade to one of the following fixed versions based on their current release train:
- Version 21.2R3-S10 or later for the 21.2 branch
- Version 21.4R3-S12 or later for the 21.4 branch
- Version 22.4R3-S8 or later for the 22.4 branch
- Version 23.2R2-S5 or later for the 23.2 branch
- Version 23.4R2-S6 or later for the 23.4 branch
- Version 24.2R2-S3 or later for the 24.2 branch
- Version 24.4R2-S1 or later for the 24.4 branch
- Version 25.2R1-S1 or 25.2R2 or later for the 25.2 branch
For detailed patch information and download links, refer to the Juniper Security Advisory JSA106004 and the Juniper Support Portal.
Workarounds
- Disable SIP ALG functionality if it is not required for legitimate business purposes
- Implement firewall rules to block or rate-limit TCP-based SIP traffic from untrusted networks
- Deploy network-based filtering upstream to inspect and sanitize SIP traffic before it reaches vulnerable devices
- Consider using an alternative SIP proxy or session border controller until patches can be applied
# Example: Disable SIP ALG on Junos OS (verify syntax for your version)
set security alg sip disable
commit
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
