Database/Firmware, BMC & network fabric
Junos OS: malformed SIP INVITE through the SIP ALG crashes flowd and stops forwarding
Impact
With the SIP ALG enabled, processing a malformed SIP INVITE crashes the flow processing daemon and restarts it, producing a complete service outage on that device until recovery. Where an SRX or SPC3 MX is the perimeter for a GPU site, a flowd crash drops everything crossing it, and an attacker who keeps sending the packet keeps the outage going. The precondition is specific - the SIP ALG must be enabled - and many datacenter deployments have no reason to run it, which makes disabling it a real mitigation rather than a nominal one. Availability only; this is a distinct code path and fix train from the TCP proxy crash (CVE-2026-57023).
Who can reach it
Network, unauthenticated: anyone who can get a SIP packet to an affected device with the SIP ALG enabled.
What to do
Upgrade Junos OS to 23.2R2-S7, 23.4R2-S8, 24.2R2-S5, 24.4R2-S4, 25.2R2, or 25.4R1-S2 per Juniper JSA110086. The upgrade reloads the device - plan a window and fail over any cluster peer. Where SIP is not needed, disabling the SIP ALG removes the exposure immediately and without a reload.
References
Related entries
- Arista EOS gNMI: crafted request from an authenticated client executes code as rootCVE-2026-73464 · Arista EOS (gNMI - gRPC Network Management Interface)High
- Cisco FXOS / NX-OS AAA: AAA implementation flaw enabling remote DoS via brute-force login attempts against the switchCVE-2017-3883 · Cisco FXOS / NX-OS AAAHigh
- Cisco NX-OS PTP feature (Nexus 5500/5600/6000): An unauthenticated remote attacker takes down a Nexus switch throughCVE-2018-0378 · Cisco NX-OS PTP feature (Nexus 5500/5600/6000)High
- Cisco NX-OS (VXLAN OAM / NGOAM): A crafted VXLAN OAM packet reloads a VTEP. In a VXLAN/EVPN GPU fabric every leaf is aCVE-2021-1587 · Cisco NX-OS (VXLAN OAM / NGOAM)High
- Intel Ethernet Adapter manageability firmware (NC-SI / sideband path): Improper input validation in the *manageability*CVE-2021-33141 · Intel Ethernet Adapter manageability firmware (NC-SI / sideband path)High
- GRUB2 (font engine, grub_font_construct_glyph): Buffer overflow when constructing a glyph from a crafted GRUB fontCVE-2022-2601 · GRUB2 (font engine, grub_font_construct_glyph)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.