CVE-2026-57026: Juniper Junos SIP ALG DoS Vulnerability – MX/SRX Series Impact

Technical summary

CVE-2026-57026 stems from improper validation of SIP INVITE packet syntax in the SIP ALG module of Junos OS. The flaw resides in input validation logic (CWE-1286: Improper Validation of Syntactic Correctness of Input) that fails to correctly parse or sanitize malformed SIP packets. When a crafted INVITE packet reaches an affected device with SIP ALG active, the flow processing daemon (flowd) encounters an unhandled condition, crashes, and triggers a restart cycle. This causes a complete interruption of traffic processing on the device until the daemon recovers. The attack surface is the network interface on which SIP traffic is processed; no authentication or user interaction is required.

Business impact

Complete service outage on affected MX and SRX Series routers until automatic recovery. For organizations relying on these platforms for carrier-grade routing, VPN termination, or security services, even brief outages disrupt business continuity, SLA compliance, and customer-facing services. Attackers can repeatedly trigger the crash, leading to repeated service interruptions. Organizations with SIP ALG enabled for VoIP inspection face higher risk, particularly carriers and enterprises with integrated telecommunications infrastructure.

Affected systems

Juniper Junos OS on MX Series (with SPC3 card) and SRX Series firewalls are affected. Vulnerable versions include all releases before 23.2R2-S7, 23.4 versions before 23.4R2-S8, 24.2 versions before 24.2R2-S5, 24.4 versions before 24.4R2-S4, 25.2 versions before 25.2R2, and 25.4 versions before 25.4R1-S2. The vulnerability only manifests when the SIP ALG feature is explicitly enabled in the device configuration.

Exploitability

Exploitability is high. The attack requires only network access and no authentication; any attacker able to send a crafted SIP packet to the target device can trigger the crash. The CVSS vector (AV:N/AC:L/PR:N/UI:N) reflects this low barrier to entry. However, the attacker must know or discover that SIP ALG is active on the target, and must be able to route traffic to the device. In production networks where SIP ALG is intentionally enabled for VoIP traffic inspection, the risk is immediate. In networks where SIP ALG is disabled, the vulnerability is not exploitable.

Remediation

Upgrade affected Junos OS versions to patched releases: 23.2R2-S7 or later, 23.4R2-S8 or later, 24.2R2-S5 or later, 24.4R2-S4 or later, 25.2R2 or later, or 25.4R1-S2 or later. As an interim mitigation, disable SIP ALG if it is not required for your network operations. Additionally, restrict network access to SIP ports (typically UDP/TCP 5060, 5061) using ACLs or firewall rules to limit the attack surface to only legitimate SIP sources.

Patch guidance

Consult Juniper's official security advisory for your specific Junos OS release train. Patch testing should be performed in a lab environment mirroring your production configuration. Coordinate upgrades during a maintenance window, as flowd crashes and restarts may temporarily disrupt traffic. Document any custom SIP ALG rules or inspection policies before patching to ensure they are preserved. For devices in high-availability pairs, upgrade one peer at a time to maintain service continuity. Verify patch installation by confirming the running version matches the target release before returning to production.

Detection guidance

Monitor flowd crash and restart events in syslog output; repeated crashes in short intervals may indicate active exploitation. Inspect SIP traffic logs for malformed INVITE packets, particularly those with invalid headers or syntax violations. Packet capture on the SIP interface can reveal attack patterns—look for INVITE packets with truncated or oversized header fields. Consider network-based IDS/IPS signatures that detect malformed SIP packets. Internal network monitoring for unusual SIP sources or traffic patterns can identify reconnaissance or attack attempts before they trigger a crash.

Why prioritize this

HIGH priority for organizations running affected MX or SRX Series devices with SIP ALG enabled. The vulnerability enables unauthenticated, network-based denial-of-service with minimal complexity. Given the criticality of MX/SRX platforms in carrier and enterprise networks, even temporary outages carry high business impact. The broad range of affected versions means many installations may be vulnerable. Organizations should verify their deployment and patch or mitigate within 30 days.

Risk score, explained

CVSS 7.5 (HIGH) reflects a severe but not critical vulnerability. The score is driven by network accessibility (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), and no user interaction (UI:N). The impact is confined to availability (A:H), with no confidentiality or integrity breach. The score does not account for business context—a brief outage on a backup router differs significantly from an outage on a primary carrier-class device. Organizations should adjust their risk rating based on device role, SIP ALG necessity, and network segmentation.

Frequently asked questions