CVE-2025-59964 Denial of service in Junos OS

High 8.7 Published 9 Oct 2025 Updated 9 Oct 2025

An unauthenticated attacker can crash the SRX4700 line card by sending traffic to the Routing Engine when sampling is enabled, causing a denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-59964?

CVE-2025-59964 is a high-severity denial of service vulnerability in Juniper Junos, published on 9 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A Use of Uninitialized Resource vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on SRX4700 devices allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS).

When forwarding-options sampling is enabled, receipt of any traffic destined to the Routing Engine (RE) by the PFE line card leads to an FPC crash and restart, resulting in a Denial of Service (DoS).

Continued receipt and processing of any traffic leading to the RE by the PFE line card will create a sustained Denial of Service (DoS) condition to the PFE line card.

This issue affects Junos OS on SRX4700:

* from 24.4 before 24.4R1-S3, 24.4R2

This issue affects IPv4 and IPv6.

Weakness: CWE-908

Which versions are affected by CVE-2025-59964?

It affects 1 product.

Products include Juniper Junos.

How do I fix CVE-2025-59964?

No fix has been published for CVE-2025-59964 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2025-59964 being exploited?

There is no known exploitation of CVE-2025-59964 in the wild and no public exploit code.

All Juniper Junos vulnerabilities

Sources

Also known as GHSA-8cjx-8cpv-m8fr.