Junos OS on SRX4700: any traffic to the Routing Engine crashes the PFE line card when sampling is enabled

CVSS 8.7CVE-2025-59964Firmware, BMC & network fabriccurated

Impact

On SRX4700 devices running Junos 24.4 with forwarding-options sampling configured, the PFE uses an uninitialized resource when handling traffic destined to the Routing Engine, crashing and restarting the FPC. Because the trigger is any IPv4 or IPv6 packet addressed to the device itself, an unauthenticated attacker who can reach the firewall's own address can hold the line card in a crash-restart loop and sustain the outage. For a datacenter that terminates tenant or management traffic on an SRX4700, this is a loss of forwarding for everything behind that line card - training jobs that span the affected path fail, and the device cannot be kept up by rate-limiting alone because ordinary management and control traffic is enough to set it off.

Who can reach it

Unauthenticated, network-based: anyone who can send IPv4 or IPv6 packets to an address owned by the Routing Engine of an affected SRX4700. Only devices with forwarding-options sampling enabled are affected.

What to do

Upgrade Junos OS on affected SRX4700 devices to 24.4R1-S3, 24.4R2 or later per JSA103153; a Junos upgrade reboots the device, so it needs a maintenance window and, on a single-homed path, an outage. If an upgrade cannot be scheduled, the configuration-level mitigation is to remove forwarding-options sampling, which stops the crash at the cost of losing flow sampling. Only the 24.4 train before those releases is listed as affected.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-59964 https://supportportal.juniper.net/JSA103153 https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/statement/sampling-edit-forwarding-options.html

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.