CVE-2023-22416
Reported by juniper · Published January 12, 2023
A Buffer Overflow vulnerability in SIP ALG of Juniper Networks Junos OS allows a network-based, unauthenticated attacker to cause a Denial of Service (DoS). On all MX Series and SRX Series platform with SIP ALG enabled, when a malformed SIP packet is received, the flow processing daemon (flowd) will crash and restart. This issue affects: Juniper Networks Junos OS on MX Series and SRX Series 20.4 versions prior to 20.4R3-S5; 21.1 versions prior to 21.1R3-S4; 21.2 versions prior to 21.2R3-S2; 21.3 versions prior to 21.3R3-S1; 21.4 versions prior to 21.4R3; 22.1 versions prior to 22.1R1-S2, 22.1R2; 22.2 versions prior to 22.2R1-S1, 22.2R2. This issue does not affect Juniper Networks Junos OS versions prior to 20.4R1 on SRX Series.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| Junos OS | Juniper Networks | 22.2R1-S1, 22.2R2, 22.1R1-S2, 22.1R2, 21.4R3, 21.3R3-S1, 21.2R3-S2, 21.1R3-S4, 20.4R3-S5, 20.4R1 |
| junos | juniper | 20.4 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Juniper Networks | Junos OS | unspecified, 20.4, 21.1 |
| Juniper Networks | Junos OS | *, 21.1, 21.2 |
Timeline
- Jan 11, 2023 CVE Published
- Jan 13, 2023 EPSS Score (30 in total, the first dated here)
- Nov 21, 2024 CVE Updated
- Apr 3, 2025 PoC Published
- May 19, 2026 Coalition ESS Score
- Jun 2, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2023-22416
vulnetix vdb fixes CVE-2023-22416Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2023-22416/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart