An improper handling of exceptional conditions in the packet forwarding engine (PFE) of Juniper Junos OS on SRX Series causes the PFE to crash when a specific ICMP packet is received through a GRE tunnel enabled with Performance Mode IPsec (PMI). The crash restarts the PFE, resulting in loss of traffic forwarded through the device. The flaw is a local network‑based interruption that can degrade or deny service to all flows handled by the affected SRX system.

The vulnerability affects Juniper Networks’ Junos OS on SRX Series platforms, including all supported SRX models such as the 1500, 1600, 2300, 300, 320, 340, 345, 380, 4100, 4120, 4200, 4300, 4600, 4700, 5400, 5600, and 5800 families. It applies to all OS releases before the following patches: 21.4R3‑S12, 22.4R3‑S8, 23.2R2‑S5, 23.4R2‑S5, 24.2R2‑S3, 24.4R2‑S1, 25.2R1‑S1, and 25.2R2. The issue is present only when PMI and GRE performance acceleration are enabled, a configuration that is not supported on all SRX platforms.

The CVSS score is 8.7, indicating a high severity while the EPSS score is below 1 %, showing a very low likelihood of exploitation in the current threat landscape. The vulnerability is not listed in the CISA KEV catalog. Attackers must be able to send a crafted ICMP packet over a GRE tunnel to the SRX device and the device must have PMI and GRE performance acceleration active. Successful exploitation would cause a PFE crash and subsequent traffic loss, effectively a denial of service for all flows routed through the affected gateway.