Junos OS (SRX firewalls)
CVE-2026-102046: MX Series: An attacker causes a Routing Engine denial of service when SCTP service is used
A Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in netsctp.ko of Juniper Networks Junos OS on MX Series allows an unauthenticated network attacker to cause a denial of service via crafted SCTP network traffic.
Published Juniper Networks advisory JSA112196
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Junos OS (MX Series) 0 | 23.2R2-S7.7 or later |
| Junos OS (MX Series) 23.4 | 23.4R2-S8.13 or later |
| Junos OS (MX Series) 24.2 | 24.2R2-S5.5 or later |
| Junos OS (MX Series) 24.4 | 24.4R2-S5 or later |
| Junos OS (MX Series) 25.2 | 25.2R2-S2 or later |
| Junos OS (MX Series) 25.4 | 25.4R1-S3 or later |
| Junos OS (MX Series) 26.2 | 26.2R1-S2 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
In short
A flaw in the SCTP kernel module causes an infinite loop when processing specific network packets. An unauthenticated attacker can send crafted SCTP traffic over the network to trigger this condition, resulting in a denial of service. No login or user interaction is required to exploit this vulnerability.
Written by a language model from the vendor's description. Versions, fixes and exploitation status on this page come straight from the vendor and CISA.
The vendor's description
A Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in netsctp.ko of Juniper Networks Junos OS on MX Series allows an unauthenticated network attacker to cause a denial of service via crafted SCTP network traffic.
Am I affected?
[ services agf amf <name> ip-address <addr> ... ]
Workarounds
There are no known workarounds for this issue.
Exploitation
Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 19 Oct 2026.