Introduction
Juniper Networks SRX4700 firewalls, widely deployed in data centers and large enterprises, are affected by a high-severity Denial of Service vulnerability (CVE-2025-59964). An attacker can trigger it remotely and without authentication, and the result is a traffic outage on a core firewall. The issue matters most in environments that use traffic sampling for monitoring or compliance, because the vulnerability is exposed only when forwarding-options sampling is enabled.
Juniper Networks is a major global vendor of networking and security products, and the SRX4700 is its high-performance firewall platform. It secures large enterprise and service provider networks, where it processes large volumes of traffic and enforces advanced security policies.
Technical information
CVE-2025-59964 is a Use of Uninitialized Resource vulnerability (CWE-908) in the Packet Forwarding Engine (PFE) of Juniper Networks SRX4700 devices running Junos OS 24.4 before 24.4R1-S3 and 24.4R2. The flaw appears only when the forwarding-options sampling feature is enabled. In that configuration, any traffic destined for the Routing Engine (RE) that the PFE line card receives and processes makes the Flexible PIC Concentrator (FPC) crash and restart. All traffic through the affected interfaces stops during the restart, which is the Denial of Service. An attacker who keeps sending RE-destined traffic can hold the FPC in a persistent crash loop and keep the outage going.
Both IPv4 and IPv6 traffic can trigger the vulnerability. The root cause is an uninitialized resource in the way the PFE handles exception traffic while sampling is active. Exploitation needs no authentication: any attacker who can send traffic to the device over the network can trigger it. No public code snippets or stack traces are available for this vulnerability. The issue requires both conditions at once, forwarding-options sampling enabled and RE-destined traffic processed by the PFE.
Affected systems and versions
- Product: Juniper Networks SRX4700
- Software: Junos OS
- Affected versions: 24.4 before 24.4R1-S3, 24.4R2
- Vulnerable configuration: forwarding-options sampling enabled
- Both IPv4 and IPv6 traffic can trigger the issue
Vendor security history
Juniper Networks has fixed Denial of Service and resource management vulnerabilities in Junos OS before. The company publishes security advisories on a regular schedule and typically ships timely patches with detailed remediation guidance. The SRX series has had other vulnerabilities in the past, and Juniper has generally responded to them and communicated about them promptly and thoroughly.
