EUVD-2026-42708
GHSA-h2m8-76wp-v324
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:X/RE:M/U:X
Network-reachable with no auth or interaction required; DoS-only impact with auto-restart limits availability to Low; unchanged scope.
Primary rating from Vendor (juniper).
CVSS VectorVendor: juniper
Lifecycle Timeline
3DescriptionCVE.org
An Out-of-bounds Write vulnerability in the http-gatekeeper (http-gk) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).
If an SRX Series device is configured for remote-access VPN with pre-logon compliance check, a network-based attacker sending specifically formatted requests can trigger an out of bounds write leading to an http-gk process crash. This crash leads to unavailability of all services depending on the [ system services web-management ] configuration (like J-Web, remote access VPN and firewall authentication) until the process automatically restarts.
This issue affects Junos OS on SRX Series:
- 23.2 versions before 23.2R2-S7,
- 23.4 versions before 23.4R2-S8,
- 24.2 versions before 24.2R2-S4,
- 24.4 versions before 24.4R2-S4,
- 25.2 versions before 25.2R2,
- 25.4 versions before 25.4R1-S1, 25.4R2.
AnalysisAI
Out-of-bounds write in the Juniper Networks Junos OS http-gatekeeper (http-gk) process on SRX Series firewalls crashes the process when handling crafted network requests, taking down all web-management-dependent services including J-Web, remote-access VPN, and firewall authentication until automatic process recovery. Exploitation is gated on a specific non-default configuration - remote-access VPN with pre-logon compliance check enabled - limiting the exposed population to SRX deployments that actively use this feature. No public exploit code and no CISA KEV listing have been identified at time of analysis, and the official CVSS 5.3 score reflects the limited, reversible availability-only impact.
Technical ContextAI
The http-gatekeeper (http-gk) is the Junos OS daemon responsible for HTTP-layer gateway services including web management (J-Web), remote-access VPN termination, and firewall authentication on SRX Series security appliances. CWE-787 (Out-of-bounds Write) indicates the root cause is a memory write operation that exceeds the bounds of its target buffer - a class of flaw that can corrupt adjacent heap or stack memory. In this case, the overflow is triggered by specifically formatted network requests arriving when the pre-logon compliance check feature of remote-access VPN is active, suggesting the malformed input reaches a code path that handles compliance negotiation packets without adequate length validation. The CPE string cpe:2.3:a:juniper_networks:junos_os:*:*:*:*:*:*:*:* confirms the vulnerability is in the Junos OS software layer, not hardware-specific firmware. The automatic restart behavior of http-gk suggests Junos OS has process-level supervision, but this also means an attacker can sustain a DoS by repeatedly sending triggering packets faster than the daemon recovers.
RemediationAI
Upgrade Junos OS on affected SRX devices to a fixed release: 23.2R2-S7 or later in the 23.2 train, 23.4R2-S8 or later in the 23.4 train, 24.2R2-S4 or later in the 24.2 train, 24.4R2-S4 or later in the 24.4 train, 25.2R2 or later in the 25.2 train, or 25.4R1-S1 / 25.4R2 or later in the 25.4 train. Full details are in the Juniper advisory at https://supportportal.juniper.net/JSA110081. As a compensating control where immediate patching is not feasible, disabling the pre-logon compliance check feature eliminates the exploitable code path, though this removes the compliance-gating capability for remote-access VPN users - evaluate whether this trade-off is acceptable for your environment. Additionally, restricting network access to the SRX management plane (J-Web and VPN gateway interfaces) to trusted source IP ranges via firewall policies reduces the attacker surface and limits who can send triggering requests, without affecting legitimate remote-access VPN functionality.
Denial-of-service in Juniper Networks Junos OS on MX Series (with SPC3) and SRX Series devices allows an unauthenticated
Remote denial of service in Juniper Networks Junos OS on MX Series (with SPC3) and SRX Series firewalls lets an unauthen
Privilege escalation in Juniper Networks Junos OS allows high-privileged local attackers to gain root access on Linux-ba
Denial-of-service in the Packet Forwarding Engine (PFE) of Juniper Junos OS on MX (with SPC3) and SRX-series firewalls l
Denial-of-service in Juniper Networks Junos OS on SRX Series devices lets an unauthenticated, network-based attacker exh
Denial-of-service in Juniper Networks Junos OS on EX Series switches (EX2300, EX3400, EX4000, EX4100, EX4400) lets a low
Denial-of-service in Juniper Junos OS on EX4100 and EX4400 Series switches allows an unauthenticated adjacent attacker t
Denial-of-service in Juniper Networks Junos OS on QFX10000 Series switches allows an unauthenticated, adjacent (Layer 2)
Denial-of-service in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series routers lets an unauth
Repeated IKE negotiation failures on Juniper Junos OS (MX with SPC3 and SRX Series) cause a peer index rollover that ass
Web filtering bypass on Juniper Networks Junos OS MX Series exposes downstream resources to unauthenticated network atta
Denial-of-service in Juniper Networks Junos OS and Junos OS Evolved on EX Series, QFX Series, and MX Series allows a loc
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today