Description
A Use After Free vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).



When web filtering for TCP traffic is configured, a high volume of DNS requests increases the likelihood of a flowd crash and restart, which leads to a complete service outage until the service has automatically recovered. This is a race condition outside the attacker's direct control.

This issue affects Junos OS on SRX Series:


* All versions before 23.2R2-S5;
* from 23.4 before 23.4R2-S6;
* from 24.2 before 24.2R2-S3;
* from 24.4 before 24.4R2-S1;
* from 25.2 before 25.2R1-S1, 25.2R2.
Published: 2026-10-14
Score: 8.2 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service via flowd crash
Action: Immediate Patch
AI Analysis

Impact

A Use After Free vulnerability in the packet forwarding engine of Juniper Networks Junos OS on SRX Series can be triggered by a high volume of DNS requests over TCP when web filtering is enabled. The flaw causes a race condition that leads to a flowd crash and restart, resulting in a complete service outage until the system automatically recovers.

Affected Systems

The vulnerability affects Juniper Networks Junos OS on SRX Series. All versions before 23.2R2‑S5, from 23.4 before 23.4R2‑S6, from 24.2 before 24.2R2‑S3, from 24.4 before 24.4R2‑S1, and from 25.2 before 25.2R1‑S1 or 25.2R2 are impacted.

Risk and Exploitability

The CVSS score of 8.2 indicates high severity, and the vulnerability is exploitable by an unauthenticated, network‑based attacker. The EPSS score of < 1% indicates a very low but nonzero exploitation probability, and the issue is not listed in CISA’s KEV catalog. No temporary workarounds are known; the sole remediation is an update to a patched release.

Generated by OpenCVE AI on October 15, 2026 at 17:12 UTC.

Remediation

Vendor Solution

The following software releases have been updated to resolve this specific issue: Junos OS: 23.2R2-S5, 23.4R2-S6, 24.2R2-S3, 24.4R2-S1, 25.2R1-S1, 25.2R2, 25.4R1, and all subsequent releases.

Vendor Workaround

There are no known workarounds for this issue.

OpenCVE Recommended Actions

  • Upgrade the SRX units to Junos OS 23.2R2‑S5 or later (or any subsequent release that includes the fix).
  • Apply traffic shaping or rate limits to DNS requests over TCP to reduce the likelihood of flowd crashes while the patch is pending.
  • Configure monitoring and alerting for flowd restarts to enable rapid response and restoration of service.

Generated by OpenCVE AI on October 15, 2026 at 17:12 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 17 Oct 2026 01:15:00 +0000

Type Values Removed Values Added
First Time appeared Juniper Networks
Juniper Networks junos Os
Vendors & Products Juniper Networks
Juniper Networks junos Os

Thu, 15 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 14 Oct 2026 16:45:00 +0000

Type Values Removed Values Added
Description A Use After Free vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). When web filtering for TCP traffic is configured, a high volume of DNS requests increases the likelihood of a flowd crash and restart, which leads to a complete service outage until the service has automatically recovered. This is a race condition outside the attacker's direct control. This issue affects Junos OS on SRX Series: * All versions before 23.2R2-S5; * from 23.4 before 23.4R2-S6; * from 24.2 before 24.2R2-S3; * from 24.4 before 24.4R2-S1; * from 25.2 before 25.2R1-S1, 25.2R2.
Title Junos OS: SRX Series: A high volume of DNS traffic over TCP can lead to a flowd crash
Weaknesses CWE-416
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 8.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/RE:M'}

Subscriptions

Juniper Networks Junos Os
cve-icon MITRE

Status: PUBLISHED

Assigner: juniper

Published:

Updated: 2026-10-14T20:26:05.668Z

Reserved: 2026-09-28T17:37:38.548Z

Link: CVE-2026-102078

cve-icon Vulnrichment

Updated: 2026-10-14T20:16:06.670Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-14T17:18:03.400

Modified: 2026-10-15T16:24:19.073

Link: CVE-2026-102078

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T01:00:13Z

Weaknesses