Junos OS (SRX firewalls)
CVE-2024-21600: PTX Series: In an FTI scenario MPLS packets hitting reject next-hop will cause a host path wedge condition
An Improper Neutralization of Equivalent Special Elements vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on PTX Series allows a unauthenticated, adjacent attacker to cause a Denial of Service (DoS).
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Junos OS (PTX1000, PTX3000, PTX5000 with FPC3, PTX10002-60C, PTX10008/16 with LC110x) 0 | 20.4R3-S8 or later |
| Junos OS (PTX1000, PTX3000, PTX5000 with FPC3, PTX10002-60C, PTX10008/16 with LC110x) 21.1 | 21.1R3-S4 or later |
| Junos OS (PTX1000, PTX3000, PTX5000 with FPC3, PTX10002-60C, PTX10008/16 with LC110x) 21.2 | 21.2R3-S6 or later |
| Junos OS (PTX1000, PTX3000, PTX5000 with FPC3, PTX10002-60C, PTX10008/16 with LC110x) 21.3 | 21.3R3-S3 or later |
| Junos OS (PTX1000, PTX3000, PTX5000 with FPC3, PTX10002-60C, PTX10008/16 with LC110x) 21.4 | 21.4R3-S5 or later |
| Junos OS (PTX1000, PTX3000, PTX5000 with FPC3, PTX10002-60C, PTX10008/16 with LC110x) 22.1 | 22.1R2-S2, 22.1R3 or later |
| Junos OS (PTX1000, PTX3000, PTX5000 with FPC3, PTX10002-60C, PTX10008/16 with LC110x) 22.2 | 22.2R2-S1, 22.2R3 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
An Improper Neutralization of Equivalent Special Elements vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on PTX Series allows a unauthenticated, adjacent attacker to cause a Denial of Service (DoS).
When MPLS packets are meant to be sent to a flexible tunnel interface (FTI) and if the FTI tunnel is down, these will hit the reject NH, due to which the packets get sent to the CPU and cause a host path wedge condition. This will cause the FPC to hang and requires a manual restart to recover.
Please note that this issue specifically affects PTX1000, PTX3000, PTX5000 with FPC3, PTX10002-60C, and PTX10008/16 with LC110x. Other PTX Series devices and Line Cards (LC) are not affected.
The following log message can be seen when the issue occurs:
Cmerror Op Set: Host Loopback: HOST LOOPBACK WEDGE DETECTED IN PATH ID <id> (URI: /fpc/<fpc>/pfe/<pfe>/cm/<cm>/Host_Loopback/<cm>/HOST_LOOPBACK_MAKE_CMERROR_ID[<id>]) This issue affects Juniper Networks Junos OS:
- All versions earlier than 20.4R3-S8;
- 21.1 versions earlier than 21.1R3-S4;
- 21.2 versions earlier than 21.2R3-S6;
- 21.3 versions earlier than 21.3R3-S3;
- 21.4 versions earlier than 21.4R3-S5;
- 22.1 versions earlier than 22.1R2-S2, 22.1R3;
- 22.2 versions earlier than 22.2R2-S1, 22.2R3.
Am I affected?
To be exposed to this issue FTI need to be configured:
[ interfaces fti0 unit <unit> tunnel ... ]
Workarounds
The issue can be prevented by configuring a limit for reject packets via:
[ system ddos-protection protocols reject aggregate bandwidth 20 ]
Exploitation
Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.