A reachable assertion bug in the SRXPFE process of Juniper Junos OS on SRX Series routers allows an attacker who can send malformed firewall‑authentication synchronization traffic to a chassis‑cluster fabric interface to crash the data plane. The vulnerability does not provide code execution or privileges escalation; its primary effect is to interrupt routing or forwarding of packets, causing a loss of service for all traffic that relies on the affected device. The weakness is classified as CWE‑617, indicating that a memory assertion or boundary check failure can be exploited to disrupt operation.

The flaw affects Juniper Networks’ Junos OS on SRX Series routers when chassis‑cluster high‑availability is enabled. The advisory lists impacted releases such as 23.2R2‑S7.7, 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1, and all subsequent versions.

With a CVSS score of 7.1, the vulnerability is considered high severity. EPSS data is not available, so the current exploitation probability is unclear, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is inferred to be local (adjacent network), as the attacker must target the chassis‑cluster fabric interfaces with specially crafted firewall‑authentication sync messages. The attacker’s goal is to trigger a reachable assertion, resulting in a data‑plane service disruption without other system compromise. No known workaround exists; the only mitigations involve applying an updated firmware release or disabling chassis‑cluster high availability until a patch is available.