Vulnerability Database

346,508

Total vulnerabilities in the database

CVE-2021-0263 — juniper / junos

Data Processing Errors

A Data Processing vulnerability in the Multi-Service process (multi-svcs) on the FPC of Juniper Networks Junos OS on the PTX Series routers may lead to the process becoming unresponsive, ultimately affecting traffic forwarding, allowing an attacker to cause a Denial of Service (DoS) condition . The Multi-Service Process running on the FPC is responsible for handling sampling-related operations when a J-Flow configuration is activated. This can occur during periods of heavy route churn, causing the Multi-Service Process to stop processing updates, without consuming any further updates from kernel. This back pressure towards the kernel affects further dynamic updates from other processes in the system, including RPD, causing a KRT-STUCK condition and traffic forwarding issues. An administrator can monitor the following command to check if there is the KRT queue is stuck: user@device > show krt state ... Number of async queue entries: 65007 <--- this value keep on increasing. The following logs/alarms will be observed when this condition exists: user@junos> show chassis alarms 2 alarms currently active Alarm time Class Description 2020-10-11 04:33:45 PDT Minor Potential slow peers are: MSP(FPC1-PIC0) MSP(FPC3-PIC0) MSP(FPC4-PIC0) Logs: Oct 11 04:33:44.672 2020 test /kernel: rts_peer_cp_recv_timeout : Bit set for msp8 as it is stuck Oct 11 04:35:56.000 2020 test-lab fpc4 user.err gldfpc-multi-svcs.elf: Error in parsing composite nexthop Oct 11 04:35:56.000 2020 test-lab fpc4 user.err gldfpc-multi-svcs.elf: composite nexthop parsing error Oct 11 04:43:05 2020 test /kernel: rt_pfe_veto: Possible slowest client is msp38. States processed - 65865741. States to be processed - 0 Oct 11 04:55:55 2020 test /kernel: rt_pfe_veto: Memory usage of M_RTNEXTHOP type = (0) Max size possible for M_RTNEXTHOP type = (8311787520) Current delayed unref = (60000), Current unique delayed unref = (10896), Max delayed unref on this platform = (40000) Current delayed weight unref = (71426) Max delayed weight unref on this platform= (400000) curproc = rpd Oct 11 04:56:00 2020 test /kernel: rt_pfe_veto: Too many delayed route/nexthop unrefs. Op 2 err 55, rtsm_id 5:-1, msg type 2 This issue only affects PTX Series devices. No other products or platforms are affected by this vulnerability. This issue affects Juniper Networks Junos OS on PTX Series: 18.2 versions prior to 18.2R3-S7; 18.3 versions prior to 18.3R3-S4; 18.4 versions prior to 18.4R2-S8, 18.4R3-S7; 19.1 versions prior to 19.1R3-S4; 19.2 versions prior to 19.2R3-S1; 19.3 versions prior to 19.3R3-S1; 19.4 versions prior to 19.4R2-S4, 19.4R3-S1; 20.1 versions prior to 20.1R2; 20.2 versions prior to 20.2R2; 20.3 versions prior to 20.3R1-S2, 20.3R2. This issue does not affect Juniper Networks Junos OS versions prior to 18.2R1.

  • Published: Apr 22, 2021
  • Updated: Nov 16, 2025
  • CVE: CVE-2021-0263
  • Severity: Medium
  • Exploit:

CVSS v3:

  • Severity: Medium
  • Score: 5.9
  • AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS v2:

  • Severity: Low
  • Score: 4.3
  • AV:N/AC:M/Au:N/C:N/I:N/A:P

CWEs:

Software From Fixed in
juniper / junos 18.2-r1 18.2-r1.x
juniper / junos 18.2 18.2.x
juniper / junos 18.2-r2-s1 18.2-r2-s1.x
juniper / junos 18.2-r2-s2 18.2-r2-s2.x
juniper / junos 18.2-r1-s3 18.2-r1-s3.x
juniper / junos 18.2-r1-s4 18.2-r1-s4.x
juniper / junos 18.2-r1-s5 18.2-r1-s5.x
juniper / junos 18.2-r2 18.2-r2.x
juniper / junos 18.2-r2-s3 18.2-r2-s3.x
juniper / junos 18.2-r2-s4 18.2-r2-s4.x
juniper / junos 18.2-r3 18.2-r3.x
juniper / junos 18.2-r2-s5 18.2-r2-s5.x
juniper / junos 18.2-r2-s6 18.2-r2-s6.x
juniper / junos 18.2-r3-s1 18.2-r3-s1.x
juniper / junos 18.2-r3-s2 18.2-r3-s2.x
juniper / junos 18.2-r3-s3 18.2-r3-s3.x
juniper / junos 18.2-r3-s4 18.2-r3-s4.x
juniper / junos 18.2-r3-s5 18.2-r3-s5.x
juniper / junos 18.2-r2-s7 18.2-r2-s7.x
juniper / junos 18.2-r3-s6 18.2-r3-s6.x
juniper / junos 18.2-r1-s2 18.2-r1-s2.x
juniper / junos 18.3-r3-s2 18.3-r3-s2.x
juniper / junos 18.3-r2-s4 18.3-r2-s4.x
juniper / junos 18.3-r3-s3 18.3-r3-s3.x
juniper / junos 18.3-r2-s3 18.3-r2-s3.x
juniper / junos 18.3-r3-s1 18.3-r3-s1.x
juniper / junos 18.3-r3 18.3-r3.x
juniper / junos 18.3-r2-s1 18.3-r2-s1.x
juniper / junos 18.3-r2-s2 18.3-r2-s2.x
juniper / junos 18.3-r1-s5 18.3-r1-s5.x
juniper / junos 18.3-r1-s6 18.3-r1-s6.x
juniper / junos 18.3-r1-s4 18.3-r1-s4.x
juniper / junos 18.3-r1-s3 18.3-r1-s3.x
juniper / junos 18.3-r1-s2 18.3-r1-s2.x
juniper / junos 18.3 18.3.x
juniper / junos 18.3-r1-s1 18.3-r1-s1.x
juniper / junos 18.3-r2 18.3-r2.x
juniper / junos 18.3-r1 18.3-r1.x
juniper / junos 18.4-r1 18.4-r1.x
juniper / junos 18.4-r1-s3 18.4-r1-s3.x
juniper / junos 18.4-r1-s4 18.4-r1-s4.x
juniper / junos 18.4-r1-s2 18.4-r1-s2.x
juniper / junos 18.4 18.4.x
juniper / junos 18.4-r1-s1 18.4-r1-s1.x
juniper / junos 18.4-r2 18.4-r2.x
juniper / junos 18.4-r1-s5 18.4-r1-s5.x
juniper / junos 18.4-r2-s2 18.4-r2-s2.x
juniper / junos 18.4-r2-s1 18.4-r2-s1.x
juniper / junos 18.4-r3 18.4-r3.x
juniper / junos 18.4-r2-s3 18.4-r2-s3.x
juniper / junos 18.4-r1-s6 18.4-r1-s6.x
juniper / junos 18.4-r3-s2 18.4-r3-s2.x
juniper / junos 18.4-r3-s1 18.4-r3-s1.x
juniper / junos 18.4-r2-s4 18.4-r2-s4.x
juniper / junos 18.4-r3-s3 18.4-r3-s3.x
juniper / junos 18.4-r3-s4 18.4-r3-s4.x
juniper / junos 18.4-r3-s6 18.4-r3-s6.x
juniper / junos 18.4-r1-s7 18.4-r1-s7.x
juniper / junos 18.4-r3-s5 18.4-r3-s5.x
juniper / junos 18.4-r2-s5 18.4-r2-s5.x
juniper / junos 18.4-r2-s6 18.4-r2-s6.x
juniper / junos 18.4-r2-s7 18.4-r2-s7.x
juniper / junos 19.1-r3-s3 19.1-r3-s3.x
juniper / junos 19.1-r1-s5 19.1-r1-s5.x
juniper / junos 19.1-r3-s2 19.1-r3-s2.x
juniper / junos 19.1-r2-s1 19.1-r2-s1.x
juniper / junos 19.1-r3 19.1-r3.x
juniper / junos 19.1-r3-s1 19.1-r3-s1.x
juniper / junos 19.1-r1-s4 19.1-r1-s4.x
juniper / junos 19.1-r2 19.1-r2.x
juniper / junos 19.1-r1-s1 19.1-r1-s1.x
juniper / junos 19.1-r1-s3 19.1-r1-s3.x
juniper / junos 19.1-r1-s2 19.1-r1-s2.x
juniper / junos 19.1-r1 19.1-r1.x
juniper / junos 19.1 19.1.x
juniper / junos 19.2-r1 19.2-r1.x
juniper / junos 19.2-r1-s1 19.2-r1-s1.x
juniper / junos 19.2-r1-s2 19.2-r1-s2.x
juniper / junos 19.2-r1-s3 19.2-r1-s3.x
juniper / junos 19.2 19.2.x
juniper / junos 19.2-r1-s4 19.2-r1-s4.x
juniper / junos 19.2-r2 19.2-r2.x
juniper / junos 19.2-r3 19.2-r3.x
juniper / junos 19.2-r1-s5 19.2-r1-s5.x
juniper / junos 19.2-r2-s1 19.2-r2-s1.x
juniper / junos 19.3-r2-s5 19.3-r2-s5.x
juniper / junos 19.3-r3 19.3-r3.x
juniper / junos 19.3-r2-s4 19.3-r2-s4.x
juniper / junos 19.3-r2-s3 19.3-r2-s3.x
juniper / junos 19.3-r2-s1 19.3-r2-s1.x
juniper / junos 19.3-r1-s1 19.3-r1-s1.x
juniper / junos 19.3-r2-s2 19.3-r2-s2.x
juniper / junos 19.3 19.3.x
juniper / junos 19.3-r1 19.3-r1.x
juniper / junos 19.3-r2 19.3-r2.x
juniper / junos 19.4-r1 19.4-r1.x
juniper / junos 19.4-r1-s1 19.4-r1-s1.x
juniper / junos 19.4-r1-s2 19.4-r1-s2.x
juniper / junos 19.4-r2 19.4-r2.x
juniper / junos 19.4-r2-s1 19.4-r2-s1.x
juniper / junos 19.4-r2-s2 19.4-r2-s2.x
juniper / junos 19.4-r3 19.4-r3.x
juniper / junos 19.4-r2-s3 19.4-r2-s3.x
juniper / junos 20.1-r1-s4 20.1-r1-s4.x
juniper / junos 20.1-r1-s2 20.1-r1-s2.x
juniper / junos 20.1-r1-s3 20.1-r1-s3.x
juniper / junos 20.1-r1-s1 20.1-r1-s1.x
juniper / junos 20.1-r1 20.1-r1.x
juniper / junos 20.2-r1 20.2-r1.x
juniper / junos 20.2-r1-s1 20.2-r1-s1.x
juniper / junos 20.2-r1-s2 20.2-r1-s2.x
juniper / junos 20.2-r1-s3 20.2-r1-s3.x
juniper / junos 20.3-r1-s1 20.3-r1-s1.x
juniper / junos 20.3-r1 20.3-r1.x

Frequently Asked Questions

A security vulnerability is a weakness in software, hardware, or configuration that can be exploited to compromise confidentiality, integrity, or availability. Many vulnerabilities are tracked as CVEs (Common Vulnerabilities and Exposures), which provide a standardized identifier so teams can coordinate patching, mitigation, and risk assessment across tools and vendors.

CVSS (Common Vulnerability Scoring System) estimates technical severity, but it doesn't automatically equal business risk. Prioritize using context like internet exposure, affected asset criticality, known exploitation (proof-of-concept or in-the-wild), and whether compensating controls exist. A "Medium" CVSS on an exposed, production system can be more urgent than a "Critical" on an isolated, non-production host.

A vulnerability is the underlying weakness. An exploit is the method or code used to take advantage of it. A zero-day is a vulnerability that is unknown to the vendor or has no publicly available fix when attackers begin using it. In practice, risk increases sharply when exploitation becomes reliable or widespread.

Recurring findings usually come from incomplete Asset Discovery, inconsistent patch management, inherited images, and configuration drift. In modern environments, you also need to watch the software supply chain: dependencies, containers, build pipelines, and third-party services can reintroduce the same weakness even after you patch a single host. Unknown or unmanaged assets (often called Shadow IT) are a common reason the same issues resurface.

Use a simple, repeatable triage model: focus first on externally exposed assets, high-value systems (identity, VPN, email, production), vulnerabilities with known exploits, and issues that enable remote code execution or privilege escalation. Then enforce patch SLAs and track progress using consistent metrics so remediation is steady, not reactive.

SynScan combines attack surface monitoring and continuous security auditing to keep your inventory current, flag high-impact vulnerabilities early, and help you turn raw findings into a practical remediation plan.