Read the docs
TI-2025-37356 Aliases CVE-2025-59975GHSA-834q-vmvq-2qjx

Junos Space: Flooding device with inbound API calls leads to WebUI and CLI management access DoS

Priority MEDIUM 44CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-400.

Summary

An Uncontrolled Resource Consumption vulnerability in the HTTP daemon (httpd) of Juniper Networks Junos Space allows an unauthenticated network-based attacker flooding the device with inbound API calls to consume all resources on the system, leading to a Denial of Service (DoS). After continuously flooding the system with inbound connection requests, all available file handles become consumed, blocking access to the system via SSH and the web user interface (WebUI), resulting in a management interface DoS. A manual reboot of the system is required to restore functionality. This issue affects Junos Space: * all versions before 22.2R1 Patch V3, * from 23.1 before 23.1R1 Patch V3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00413 35th percentileScored 2026-11-07
Fix Fixed Junos Space (Juniper Networks): 22.2R1 Patch V3, 23.1R1 Patch V3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
JuniperJunos Spacebefore 22.2R1 Patch V3; 23.1 to before 23.1R1 Patch V322.2R1 Patch V3, 23.1R1 Patch V3Patch availableCNA
  • Junos Space VendorJuniper Affected before 22.2R1 Patch V3; 23.1 to before 23.1R1 Patch V3 Fixed in 22.2R1 Patch V3, 23.1R1 Patch V3 Patch available CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:juniper:junos_space:*:*:*:*:*:*:*:*before 22.2VulnerableJuniper
cpe:2.3:a:juniper:junos_space:22.2:r1:*:*:*:*:*:*22.2 r1VulnerableJuniper
cpe:2.3:a:juniper:junos_space:23.1:r1:*:*:*:*:*:*23.1 r1VulnerableJuniper
  • cpe:2.3:a:juniper:junos_space:*:*:*:*:*:*:*:* Versions before 22.2 Vulnerable ·Juniper
  • cpe:2.3:a:juniper:junos_space:22.2:r1:*:*:*:*:*:* Versions 22.2 r1 Vulnerable ·Juniper
  • cpe:2.3:a:juniper:junos_space:23.1:r1:*:*:*:*:*:* Versions 23.1 r1 Vulnerable ·Juniper

Remediation

  • Fix · CNA Junos Space (Juniper Networks) Fixed in 22.2R1 Patch V3, 23.1R1 Patch V3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-59975
  2. 2026-10-03 Alias added: GHSA-834q-vmvq-2qjx

References

Advisory 1

  • TI-2014-00408 Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1… CVSS 2.0HIGH 10.0
  • TI-2014-01931 Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JavaFX 2.2.51; and… CVSS 2.0HIGH 10.0
  • TI-2014-00436 Unspecified vulnerability in Oracle Java SE 5.0u61, SE 6u71, 7u51, and 8; JRockit R27.8.1… CVSS 2.0HIGH 10.0
  • TI-2014-00435 Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51… CVSS 2.0HIGH 10.0
  • TI-2017-07788 Junos Space: Authentication bypass vulnerability CVSS 3.0CRITICAL 9.8
  • TI-2014-02744 Unspecified vulnerability in Juniper Junos Space before 13.3R1.8, when the firewall in… CVSS 2.0HIGH 10.0
See all 78 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences