A null pointer dereference in the DNS plugin of Juniper Networks Junos OS on SRX Series permits an unauthenticated, network-based attacker to trigger a complete denial‑of‑service by causing the flowd process to crash. The flaw occurs when a DNS query that matches the Security Intelligence feed is processed concurrently with another query of a DNS domain generation algorithm type, leading to an error in logging of these asynchronous tasks. The crash results from the DNS plugin’s inability to properly handle the second query’s data, causing a flowd process termination and a temporary loss of packet forwarding capability for the device. The vulnerability is classified as an improper use of a null pointer dereference (CWE‑476).

All Juniper Networks Junos OS releases on SRX Series that are earlier than 23.2R2‑S7.7, 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S4, 25.2R2‑S1, and 25.4R1‑S2 are affected. The issue is resolved in all subsequent releases listed by Juniper.

The flaw carries a CVSS score of 8.2, indicating high severity. The EPSS score is 0.00367, indicating an extremely low exploitation probability, but the lack of authentication requirements means any device on a routable network segment could still be targeted. The vulnerability is not listed in CISA’s KEV catalog, suggesting no known active exploits at this time. Exploitation requires only that the attacker generate or observe two DNS queries in the same session that trigger the asynchronous logging conflict; however, the exact timing needed for the crash is outside the attacker’s direct control, which slightly mitigates the risk. Overall, the risk is high but constrained by the need for specific traffic patterns and an unspecified timing condition.