Junos OS MX Series: Denial of service via crafted SCTP traffic (infinite loop)
Summary
An infinite loop in the netsctp.ko kernel module of Junos OS on MX Series routers allows an unauthenticated remote attacker to cause a denial of service on the Routing Engine by sending crafted SCTP network traffic. The CNA CVSS 4.0 vector indicates high availability impact only, with no confidentiality or integrity loss. The issue is only relevant if the router accepts SCTP traffic from untrusted networks, and the record describes a required configuration involving services agf amf.
Affected
- Junos OS 0 to before 23.2R2-S7.7
- Junos OS 23.4 to before 23.4R2-S8.13
- Junos OS 24.2 to before 24.2R2-S5.5
- Junos OS 24.4 to before 24.4R2-S5
- Junos OS 25.2 to before 25.2R2-S2
- Junos OS 25.4 to before 25.4R1-S3
- Junos OS 26.2 to before 26.2R1-S2
- Default configuration: unaffected
- Required configuration: services agf amf <name> ip-address <addr>
- Version data per CNA record; not yet verified against the vendor advisory.
Fixed in
- Junos OS 23.2R2-S7.7
- Junos OS 23.4R2-S8.13
- Junos OS 24.2R2-S5.5
- Junos OS 24.4R2-S5
- Junos OS 25.2R2-S2
- Junos OS 25.4R1-S3 or 25.4R2
- Junos OS 26.2R1-S2 or 26.2R2
- Junos OS 26.4R1 and all subsequent releases
- Note: respins exist for 23.2, 23.4 and 24.2; previously published versions were rebuilt.
Workaround
Unknown. The vendor record states that there are no known workarounds.
Exploitation
- Juniper SIRT is not aware of any malicious exploitation.
- Not listed in CISA KEV.
- No public proof of concept found in the sources checked.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
Our recommendation
- Identify any MX Series routers and their Junos OS versions.
- Compare the versions with the fixed-version list and apply the vendor patch or respin.
- Check the Juniper advisory JSA112196 for the current status.
- Ask your ISP or managed-service provider for their patch status if they operate affected routers.
- Restrict SCTP exposure at the perimeter and limit control-plane access as a generic measure.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Juniper advisory JSA112196 supportportal.juniper.net
- VulnRichment CVE-2026-102046 vulners.com
- Strix CVE-2026-102046 www.strix.ai
- ThreatInt CVE-2026-102046 cve.threatint.com
- OpenCVE CVE-2026-102046 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 03:14.
Original description (NVD)
A Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in netsctp.ko of Juniper Networks Junos OS on MX Series allows an unauthenticated network attacker to cause a denial of service via crafted SCTP network traffic.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.