LiveActive security incident?Get immediate response
CVE Record

CVE-2021-0263: Junos OS: PTX Series: Denial of Service in packet processing due to heavy route churn when J-Flow sampling is enabled

A Data Processing vulnerability in the Multi-Service process (multi-svcs) on the FPC of Juniper Networks Junos OS on the PTX Series routers may lead to the process becoming unresponsive, ultimately affecting traffic forwarding, allowing an attacker to cause a Denial of Service (DoS) condition . The Multi-Service Process running on the FPC is responsible for handling sampling-related operations when a J-Flow configuration is activated. This can occur during periods of heavy route churn, causing the Multi-Service Process to stop processing updates, without consuming any further updates from kernel. This back pressure towards the kernel affects further dynamic updates from other processes in the system, including RPD, causing a KRT-STUCK condition and traffic forwarding issues. An administrator can monitor the following command to check if there is the KRT queue is stuck: user@device > show krt state ... Number of async queue entries: 65007 <--- this value keep on increasing. The following logs/alarms will be observed when this condition exists: user@junos> show chassis alarms 2 alarms currently active Alarm time Class Description 2020-10-11 04:33:45 PDT Minor Potential slow peers are: MSP(FPC1-PIC0) MSP(FPC3-PIC0) MSP(FPC4-PIC0) Logs: Oct 11 04:33:44.672 2020 test /kernel: rts_peer_cp_recv_timeout : Bit set for msp8 as it is stuck Oct 11 04:35:56.000 2020 test-lab fpc4 user.err gldfpc-multi-svcs.elf: Error in parsing composite nexthop Oct 11 04:35:56.000 2020 test-lab fpc4 user.err gldfpc-multi-svcs.elf: composite nexthop parsing error Oct 11 04:43:05 2020 test /kernel: rt_pfe_veto: Possible slowest client is msp38. States processed - 65865741. States to be processed - 0 Oct 11 04:55:55 2020 test /kernel: rt_pfe_veto: Memory usage of M_RTNEXTHOP type = (0) Max size possible for M_RTNEXTHOP type = (8311787520) Current delayed unref = (60000), Current unique delayed unref = (10896), Max delayed unref on this platform = (40000) Current delayed weight unref = (71426) Max delayed weight unref on this platform= (400000) curproc = rpd Oct 11 04:56:00 2020 test /kernel: rt_pfe_veto: Too many delayed route/nexthop unrefs. Op 2 err 55, rtsm_id 5:-1, msg type 2 This issue only affects PTX Series devices. No other products or platforms are affected by this vulnerability. This issue affects Juniper Networks Junos OS on PTX Series: 18.2 versions prior to 18.2R3-S7; 18.3 versions prior to 18.3R3-S4; 18.4 versions prior to 18.4R2-S8, 18.4R3-S7; 19.1 versions prior to 19.1R3-S4; 19.2 versions prior to 19.2R3-S1; 19.3 versions prior to 19.3R3-S1; 19.4 versions prior to 19.4R2-S4, 19.4R3-S1; 20.1 versions prior to 20.1R2; 20.2 versions prior to 20.2R2; 20.3 versions prior to 20.3R1-S2, 20.3R2. This issue does not affect Juniper Networks Junos OS versions prior to 18.2R1.

MediumCVSS 5.9Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This issue can disrupt traffic forwarding on Juniper PTX routers when J-Flow sampling is enabled during heavy routing changes. It is availability-focused, not data theft. The main business risk is service interruption on core routing infrastructure if affected Junos OS releases remain in production.

Executive priority

Treat as a targeted infrastructure availability risk. It is not broadly applicable across all Juniper products, but affected PTX routers may sit in critical traffic paths. Remediate through planned network maintenance, prioritizing routers with J-Flow enabled.

Technical view

The multi-svcs process on PTX FPCs can become unresponsive under heavy route churn with J-Flow active. That can create kernel back pressure, affect RPD dynamic updates, produce KRT-STUCK behavior, and cause forwarding problems. CVSS 3.1 is 5.9 with high attack complexity and availability impact only.

Likely exposure

Exposure is limited to Juniper Networks Junos OS on PTX Series routers running affected 18.2 through 20.3 releases below the fixed versions. Juniper states no other products or platforms are affected, and versions before 18.2R1 are not affected.

Exploitation context

The source describes a network-reachable, unauthenticated denial-of-service condition, but with high attack complexity. It depends on heavy route churn while J-Flow sampling is enabled. KEV is false and the supplied sources do not cite active exploitation.

Researcher notes

Evidence is vendor-specific and complete enough for scoping: PTX only, J-Flow-related sampling path, route churn trigger, and fixed release thresholds. The provided material does not establish public exploitation, a general workaround, or impact beyond denial of service.

Mitigation direction

  • Upgrade affected PTX routers to the applicable fixed Junos OS release listed by Juniper.
  • Prioritize PTX routers with J-Flow sampling enabled and high route-change exposure.
  • Review Juniper JSA11154 for current vendor guidance before operational changes.
  • Keep non-PTX assets out of scope unless separate evidence identifies exposure.

Validation and detection

  • Inventory PTX Series routers and their Junos OS versions.
  • Confirm whether J-Flow sampling is enabled on each PTX router.
  • Compare installed releases against Juniper's fixed version thresholds.
  • Monitor for increasing KRT async queue entries and KRT-STUCK indicators.
  • Review chassis alarms and multi-svcs or kernel logs for advisory-matching symptoms.
Prepared
Confidence
high
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-19: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2021-0263 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
5.9 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
5.9CVSS 3.1MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H2.23.6Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

5.9Medium
CVSS 3.1 vector shape for CVE-2021-0263Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
Juniper NetworksJunos OSunspecifiedListed
Juniper NetworksJunos OS18.2, 18.3, 18.4, 19.1, 19.2, 19.3, 19.4, 20.1, 20.2, 20.3Listed
Weakness

CWE details

CWE-19

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-19 · source CWE mapping

Data Processing Errors

Data Processing Errors represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs