Juniper Junos OS CVE-2026-102078

Exploitation requires the SRX device to be configured with web filtering for TCP traffic - this is the specific, non-default feature prerequisite; devices without this configuration are not affected. The trigger is a high volume of DNS requests that must coincide with a race condition in the packet forwarding engine that is explicitly outside the attacker's direct control, so success is probabilistic rather than guaranteed. Limiting factors: the attack only yields a temporary DoS (flowd auto-restarts and recovers), has no confidentiality or integrity impact, and depends on reachability to the firewall's traffic path plus the enabled web-filtering feature; affected version ranges are bounded (before 23.2R2-S5, 23.4 before 23.4R2-S6, 24.2 before 24.2R2-S3, 24.4 before 24.4R2-S1, 25.2 before 25.2R1-S1/25.2R2).

This is a legitimately elevated but conditional risk. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) scores 8.2 HIGH and confirms a network-reachable, unauthenticated vector with no user interaction, which is why the score is high. However, the single most important signal is AT:P (Attack Requirements: Present) combined with the vendor's own statement that the crash is 'a race condition outside the attacker's direct control.' This means an attacker cannot deterministically trigger the flaw - they can only raise the probability of a flowd crash by flooding DNS traffic. Impact is availability-only (VC:N/VI:N/VA:H, with SA:L for the dependent service outage); there is no confidentiality or integrity exposure. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active or automatable exploitation. Net assessment: a credible DoS worth patching on exposed SRX firewalls, but not a drop-everything emergency - the probabilistic race condition and the requirement for a specific non-default feature (TCP web filtering) materially lower real-world exploitability below what the raw 8.2 might suggest. No conflicting signals in the data; the main caveat is that exploitation reliability is explicitly non-deterministic per the vendor.

An attacker who can reach an internet-facing or inline SRX firewall configured for TCP web filtering sends a sustained high volume of DNS requests through the device, aiming to win a timing race that triggers a use-after-free in the packet forwarding engine. A successful trigger crashes and restarts flowd, dropping all traffic through the firewall until it auto-recovers. No public exploit code is identified at time of analysis, and the vendor notes the crash depends on a race condition the attacker cannot directly control.