Description
A Double Free vulnerability in the flow processing daemon (flowd) of Juniper Networks Junos OS on SRX and MX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). On all SRX and MX Series platforms, when during TCP session establishment a specific sequence of packets is encountered a double free happens. This causes flowd to crash and the respective FPC to restart.





This issue affects Junos OS on SRX and MX Series:



* all versions before 22.4R3-S7,
* 23.2 versions before 23.2R2-S3,
* 23.4 versions before 23.4R2-S4,
* 24.2 versions before 24.2R2.
Published: 2026-01-15
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service through a double‑free in the flowd process
Action: Patch Immediately
AI Analysis

Impact

A double‑free flaw in the flow usage daemon of Juniper Networks Junos OS on SRX and MX series allows an unauthenticated, network‑based attacker to trigger a crash of flowd. When a specific sequence of TCP packets occurs during a TCP session establishment the flaw is triggered, causing flowd to terminate and the faulty forwarding plane card (FPC) to restart. This results in a denial‑of‑service condition for the affected device.

Affected Systems

All Juniper Networks Junos OS on SRX and MX Series platforms are affected, including versions released before 22.4R3‑S7, before 23.2R2‑S3, before 23.4R2‑S4, and before 24.2R2. The update releases listed by Juniper—22.4R3‑S7, 23.2R2‑S3, 23.4R2‑S4, 24.2R2, 24.4R1, and any subsequent releases—contain the fix.

Risk and Exploitability

The vulnerability carries a CVSS score of 8.7, indicating high severity, while the EPSS score is below 1 %, implying that true exploitation probability is low. The flaw is not currently in the CISA KEV catalog. Attackers can provoke the double‑free by sending a crafted TCP packet sequence across an unauthenticated network channel to the targeted device, so the threat is limited to networks with exposure to the SRX or MX device. Organizations should treat the risk as moderate to high and act promptly to apply the vendor‑supplied updates.

Generated by OpenCVE AI on April 18, 2026 at 05:56 UTC.

Remediation

Vendor Solution

The following software releases have been updated to resolve this specific issue: 22.4R3-S7, 23.2R2-S3, 23.4R2-S4, 24.2R2, 24.4R1, and all subsequent releases.

Vendor Workaround

There are no known workarounds for this issue.

OpenCVE Recommended Actions

  • Upgrade every SRX and MX Series device to a fixed release—any of 22.4R3‑S7, 23.2R2‑S3, 23.4R2‑S4, 24.2R2, 24.4R1 or later—ensuring the binary includes the patch for flowd.
  • While the upgrade is pending, enforce strict access controls on interfaces that expose the device to untrusted networks. Use ACLs or firewall rules to block traffic that could generate the specific TCP session establishment pattern known to trigger the double‑free, focusing on limiting outbound TCP handshakes from non‑trusted sources.
  • Schedule a maintenance window to apply the firmware update, then verify stability by monitoring flowd logs and device performance for any recurrence of crashes.

Generated by OpenCVE AI on April 18, 2026 at 05:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Jan 2026 19:45:00 +0000

Type Values Removed Values Added
First Time appeared Juniper
Juniper junos
Juniper mx10004
Juniper mx10008
Juniper mx2008
Juniper mx2010
Juniper mx2020
Juniper mx204
Juniper mx240
Juniper mx304
Juniper mx480
Juniper mx960
Juniper srx1500
Juniper srx1600
Juniper srx2300
Juniper srx300
Juniper srx320
Juniper srx340
Juniper srx345
Juniper srx380
Juniper srx4100
Juniper srx4120
Juniper srx4200
Juniper srx4300
Juniper srx4600
Juniper srx4700
Juniper srx5400
Juniper srx5600
Juniper srx5800
CPEs cpe:2.3:h:juniper:mx10004:-:*:*:*:*:*:*:*
cpe:2.3:h:juniper:mx10008:-:*:*:*:*:*:*:*
cpe:2.3:h:juniper:mx2008:-:*:*:*:*:*:*:*
cpe:2.3:h:juniper:mx2010:-:*:*:*:*:*:*:*
cpe:2.3:h:juniper:mx2020:-:*:*:*:*:*:*:*
cpe:2.3:h:juniper:mx204:-:*:*:*:*:*:*:*
cpe:2.3:h:juniper:mx240:-:*:*:*:*:*:*:*
cpe:2.3:h:juniper:mx304:-:*:*:*:*:*:*:*
cpe:2.3:h:juniper:mx480:-:*:*:*:*:*:*:*
cpe:2.3:h:juniper:mx960:-:*:*:*:*:*:*:*
cpe:2.3:h:juniper:srx1500:-:*:*:*:*:*:*:*
cpe:2.3:h:juniper:srx1600:-:*:*:*:*:*:*:*
cpe:2.3:h:juniper:srx2300:-:*:*:*:*:*:*:*
cpe:2.3:h:juniper:srx300:-:*:*:*:*:*:*:*
cpe:2.3:h:juniper:srx320:-:*:*:*:*:*:*:*
cpe:2.3:h:juniper:srx340:-:*:*:*:*:*:*:*
cpe:2.3:h:juniper:srx345:-:*:*:*:*:*:*:*
cpe:2.3:h:juniper:srx380:-:*:*:*:*:*:*:*
cpe:2.3:h:juniper:srx4100:-:*:*:*:*:*:*:*
cpe:2.3:h:juniper:srx4120:-:*:*:*:*:*:*:*
cpe:2.3:h:juniper:srx4200:-:*:*:*:*:*:*:*
cpe:2.3:h:juniper:srx4300:-:*:*:*:*:*:*:*
cpe:2.3:h:juniper:srx4600:-:*:*:*:*:*:*:*
cpe:2.3:h:juniper:srx4700:-:*:*:*:*:*:*:*
cpe:2.3:h:juniper:srx5400:-:*:*:*:*:*:*:*
cpe:2.3:h:juniper:srx5600:-:*:*:*:*:*:*:*
cpe:2.3:h:juniper:srx5800:-:*:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:22.4:-:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:22.4:r1-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:22.4:r1-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:22.4:r1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:22.4:r2-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:22.4:r2-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:22.4:r2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:22.4:r3-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:22.4:r3-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:22.4:r3-s3:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:22.4:r3-s4:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:22.4:r3-s5:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:22.4:r3-s6:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:22.4:r3:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:23.2:-:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:23.2:r1-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:23.2:r1-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:23.2:r1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:23.2:r2-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:23.2:r2-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:23.2:r2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:23.4:-:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:23.4:r1-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:23.4:r1-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:23.4:r1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:23.4:r2-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:23.4:r2-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:23.4:r2-s3:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:23.4:r2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:24.2:-:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:24.2:r1-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:24.2:r1-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:24.2:r1:*:*:*:*:*:*
Vendors & Products Juniper
Juniper junos
Juniper mx10004
Juniper mx10008
Juniper mx2008
Juniper mx2010
Juniper mx2020
Juniper mx204
Juniper mx240
Juniper mx304
Juniper mx480
Juniper mx960
Juniper srx1500
Juniper srx1600
Juniper srx2300
Juniper srx300
Juniper srx320
Juniper srx340
Juniper srx345
Juniper srx380
Juniper srx4100
Juniper srx4120
Juniper srx4200
Juniper srx4300
Juniper srx4600
Juniper srx4700
Juniper srx5400
Juniper srx5600
Juniper srx5800

Fri, 16 Jan 2026 14:15:00 +0000

Type Values Removed Values Added
First Time appeared Juniper Networks
Juniper Networks junos Os
Vendors & Products Juniper Networks
Juniper Networks junos Os

Thu, 15 Jan 2026 22:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 15 Jan 2026 20:45:00 +0000

Type Values Removed Values Added
Description A Double Free vulnerability in the flow processing daemon (flowd) of Juniper Networks Junos OS on SRX and MX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). On all SRX and MX Series platforms, when during TCP session establishment a specific sequence of packets is encountered a double free happens. This causes flowd to crash and the respective FPC to restart. This issue affects Junos OS on SRX and MX Series: * all versions before 22.4R3-S7, * 23.2 versions before 23.2R2-S3, * 23.4 versions before 23.4R2-S4, * 24.2 versions before 24.2R2.
Title Junos OS: SRX and MX Series: When TCP packets occur in a specific sequence flowd crashes
Weaknesses CWE-415
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/RE:M'}
cve-icon MITRE

Status: PUBLISHED

Assigner: juniper

Published:

Updated: 2026-01-15T21:13:00.740Z

Reserved: 2026-01-05T17:32:48.711Z

Link: CVE-2026-21918

cve-icon Vulnrichment

Updated: 2026-01-15T21:12:58.010Z

cve-icon NVD

Status : Analyzed

Published: 2026-01-15T21:16:08.050

Modified: 2026-01-23T19:41:38.067

Link: CVE-2026-21918

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-18T06:00:08Z

Weaknesses