CVE-2025-21594

Technical Description

An Improper Check for Unusual or Exceptional Conditions vulnerability in the pfe (packet forwarding engine) of Juniper Networks Junos OS on MX Series causes a port within a pool to be blocked leading to Denial of Service (DoS).

In a DS-Lite (Dual-Stack Lite) and NAT (Network Address Translation) scenario, when crafted IPv6 traffic is received and prefix-length is set to 56, the ports assigned to the user will not be freed.  Eventually, users cannot establish new connections. Affected FPC/PIC need to be manually restarted to recover.

Following is the command to identify the issue: 

    user@host> show services nat source port-block 

    Host_IP                     External_IP                   Port_Block      Ports_Used/       Block_State/

                                                              Range           Ports_Total       Left_Time(s)

    2001::                        x.x.x.x                     58880-59391     256/256*1         Active/-       >>>>>>>>port still

Remediation

Check the references section for vendor advisories and patches from juniper. Update junos to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References