CVE-2025-52981

An Improper Check for Unusual or Exceptional Conditions vulnerability in the flow processing daemon (flowd) of Juniper Networks Junos OS on SRX1600, SRX2300, SRX 4000 Series, and SRX5000 Series with SPC3 allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). If a sequence of specific PIM packets is received, this will cause a flowd crash and restart. This issue affects Junos OS: * all versions before 21.2R3-S9, * 21.4 versions before 21.4R3-S11, * 22.2 versions before 22.2R3-S7, * 22.4 versions before 22.4R3-S6, * 23.2 versions before 23.2R2-S4, * 23.4 versions before 23.4R2-S4, * 24.2 versions before 24.2R2. This is a similar, but different vulnerability than the issue reported as CVE-2024-47503, published in JSA88133.

Scoring

Severity

HIGH

CVSS base score

8.7

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/RE:M

EPSS probability

0.44%

CWE

CWE-754

Published

2025-07-11

Last modified

2026-03-13

Affected products

• Juniper Networks Junos OS
• Juniper Networks Junos OS
• Juniper Networks Junos OS
• Juniper Networks Junos OS
• Juniper Networks Junos OS
• Juniper Networks Junos OS
• Juniper Networks Junos OS

Weakness type

• CWE-754

Related vulnerabilities

• CVE-2026-87012 — Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value
• CVE-2026-87656 — Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed a remote...
• CVE-2026-87532 — Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed a remote...
• CVE-2026-87548 — Improper state validation in Installer in Google Chrome prior to 153.0.8010.36 allowed a remote...
• CVE-2026-87645 — Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed a remote...
• CVE-2026-73314 — XenForo < 2.3.13 Signature Verification Bypass via PayPal REST Webhook
• CVE-2026-85014 — undici vulnerable to Denial of Service via WebSocketStream unclean close
• CVE-2026-55484 — ALOS HTTP: Unauthenticated remote DoS: malformed path starting with "?" triggers out-of-bounds panic in sanitizeRequestPath, crashing entire server

Markdown version · Browse all CVEs