Junos OS (SRX firewalls)
CVE-2025-21594: MX Series: In DS-lite and NAT scenario receipt of crafted IPv6 traffic causes port block
An Improper Check for Unusual or Exceptional Conditions vulnerability in the pfe (packet forwarding engine) of Juniper Networks Junos OS on MX Series causes a port within a pool to be blocked leading to Denial of Service (DoS).
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Junos OS (MX Series) 0 | 21.2R3-S8 or later |
| Junos OS (MX Series) 21.4 | 21.4R3-S7 or later |
| Junos OS (MX Series) 22.1 | 22.1R3-S6 or later |
| Junos OS (MX Series) 22.2 | 22.2R3-S4 or later |
| Junos OS (MX Series) 22.3 | 22.3R3-S3 or later |
| Junos OS (MX Series) 22.4 | 22.4R3-S2 or later |
| Junos OS (MX Series) 23.2 | 23.2R2-S1 or later |
| Junos OS (MX Series) 23.4 | 23.4R1-S2, 23.4R2 or later |
| Junos OS (MX Series) 0 | Not affected |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
An Improper Check for Unusual or Exceptional Conditions vulnerability in the pfe (packet forwarding engine) of Juniper Networks Junos OS on MX Series causes a port within a pool to be blocked leading to Denial of Service (DoS).
In a DS-Lite (Dual-Stack Lite) and NAT (Network Address Translation) scenario, when crafted IPv6 traffic is received and prefix-length is set to 56, the ports assigned to the user will not be freed. Eventually, users cannot establish new connections. Affected FPC/PIC need to be manually restarted to recover. Following is the command to identify the issue:
user@host> show services nat source port-block Host_IP External_IP Port_Block Ports_Used/ Block_State/ Range Ports_Total Left_Time(s) 2001:: x.x.x.x 58880-59391 256/256*1 Active/- >>>>>>>>port still usedThis issue affects Junos OS on MX Series:
- from 21.2 before 21.2R3-S8,
- from 21.4 before 21.4R3-S7,
- from 22.1 before 22.1R3-S6,
- from 22.2 before 22.2R3-S4,
- from 22.3 before 22.3R3-S3,
- from 22.4 before 22.4R3-S2,
- from 23.2 before 23.2R2-S1,
- from 23.4 before 23.4R1-S2, 23.4R2.
This issue does not affect versions before 20.2R1.
Am I affected?
This issue only occurs when below config is enabled:
[ set services service-set <*> softwire-options dslite-ipv6-prefix-length 56]
Workarounds
Modify the IPv6 prefix-length to be 64/96/128 through the command:
[ set services service-set <*> softwire-options dslite-ipv6-prefix-length 64/96/128]
Exploitation
Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.