A signed‑to‑unsigned conversion error in the srxpfe component of Juniper Networks Junos OS for the SRX Series allows an adjacent attacker to cause a denial of service of the router’s data plane when chassis‑cluster high availability is used. The error can be triggered by sending specifically crafted chassis‑cluster fabric traffic, which disrupts packet forwarding and results in the loss of throughput for all locally connected users. The primary weakness is a type of integer conversion flaw (CWE‑195) that can be exploited without compromising the control plane or gaining code execution.

The vulnerability affects Juniper Networks Junos OS running on SRX Series devices. Affected releases include Junos OS 23.2R2‑S7.7, 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1, and all subsequent releases, as well as the equivalent Junos OS Evolved releases 23.2R2‑S7.7‑EVO, 23.4R2‑S8.11‑EVO, 24.2R2‑S5.6‑EVO, 24.4R2‑S5‑EVO, 25.2R2‑S2‑EVO, 25.2X100‑D35‑EVO, 25.4R1‑S3‑EVO, 25.4R2‑EVO, 25.4X300‑D40‑EVO, 26.2R1‑S2‑EVO, 26.2R2‑EVO, 26.4R1‑EVO, and all subsequent releases.

The CVSS score of 7.1 indicates a high impact level, while the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires an attacker to be adjacent to the SRX device and to be able to generate chassis‑cluster fabric traffic; no formal workaround exists, so the only viable protection is to apply the vendor‑supplied software updates promptly. Given the severity and the availability of a fix, the risk warrants immediate attention.