EUVD-2026-42709
GHSA-fw4x-gm4m-gfp9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:A/V:X/RE:M/U:X
Network-reachable and unauthenticated (AV:N/PR:N), but AC:H reflects the requirement that the device initiate an outbound connection to the attacker; impact is availability-only PFE DoS (A:H).
Primary rating from Vendor (juniper).
CVSS VectorVendor: juniper
Lifecycle Timeline
8DescriptionCVE.org
An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX with SPC3 and SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).
When an affected device initiates a TCP connection to an attacker-controlled system that responds with a specific packet, this causes a PFE crash and restart, which affects all services until the system has automatically recovered. This issue can happen among others in the following scenarios: ALG, SSL proxy, UTM, RTLOG, AppQoE probing, AAMW, ICAP, URL filtering.
This issue affects Junos OS on MX Series with SPC3, SRX5k Series with SPC3, SRX1600 Series, SRX2300 Series, SRX4000 Series, and vSRX Series:
- all versions before 23.2R2-S4,
- 23.4 versions before 23.4R2-S5,
- 24.2 versions before 24.2R2.
Articles & Coverage 1
AnalysisAI
Denial-of-service in the Packet Forwarding Engine (PFE) of Juniper Junos OS on MX (with SPC3) and SRX-series firewalls lets an unauthenticated, network-based attacker crash and restart the PFE, dropping all traffic-forwarding services until automatic recovery. Exploitation is indirect: the attacker must lure or wait for the affected device to initiate an outbound TCP connection to an attacker-controlled system, which then replies with a crafted packet that trips an unhandled exceptional condition (CWE-754). Juniper-reported with CVSS 4.0 8.2; no public exploit identified at time of analysis and it is not in CISA KEV.
Technical ContextAI
The flaw sits in the PFE, the data-plane forwarding hardware/software on Juniper MX (SPC3 service card) and SRX platforms that handles high-touch flow processing. It is triggered only during PFE-driven outbound TCP sessions used by flow-based services - ALG, SSL proxy, UTM, RTLOG, AppQoE probing, AAMW (Advanced Anti-Malware), ICAP, and URL filtering - where the device acts as the TCP client toward an external server. The root cause is CWE-754, Improper Check for Unusual or Exceptional Conditions: the PFE fails to validate a specific unexpected response packet from the peer, leading to a crash rather than graceful handling. CPE data confirms the affected package as cpe:2.3:a:juniper_networks:junos_os, though the CPE wildcard does not itself enumerate the platform/version constraints given in the advisory text.
RemediationAI
Vendor-released patch: upgrade to Junos OS 23.2R2-S4, 23.4R2-S5, 24.2R2, or later per Juniper advisory JSA110082 (https://supportportal.juniper.net/JSA110082). Where immediate patching is not possible, reduce exposure by limiting which external destinations the PFE will initiate connections to for the affected services - for example, restrict URL-filtering/AAMW/ICAP/RTLOG/SSL-proxy callouts and AppQoE probing to trusted, controlled servers, and use firewall filters to constrain outbound flows from these services; the trade-off is reduced security-service coverage or logging while the control is in place. If a specific service (e.g., SSL proxy or UTM URL filtering) is not required, disabling it removes the trigger path at the cost of that inspection capability. There is no reliable workaround that preserves all services, so patching is the durable fix; confirm exact fixed builds for your platform in JSA110082 before upgrading.
Denial-of-service in Juniper Networks Junos OS on MX Series (with SPC3) and SRX Series devices allows an unauthenticated
Remote denial of service in Juniper Networks Junos OS on MX Series (with SPC3) and SRX Series firewalls lets an unauthen
Privilege escalation in Juniper Networks Junos OS allows high-privileged local attackers to gain root access on Linux-ba
Denial-of-service in Juniper Networks Junos OS on SRX Series devices lets an unauthenticated, network-based attacker exh
Denial-of-service in Juniper Networks Junos OS on EX Series switches (EX2300, EX3400, EX4000, EX4100, EX4400) lets a low
Denial-of-service in Juniper Junos OS on EX4100 and EX4400 Series switches allows an unauthenticated adjacent attacker t
Denial-of-service in Juniper Networks Junos OS on QFX10000 Series switches allows an unauthenticated, adjacent (Layer 2)
Denial-of-service in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series routers lets an unauth
Out-of-bounds write in the Juniper Networks Junos OS http-gatekeeper (http-gk) process on SRX Series firewalls crashes t
Repeated IKE negotiation failures on Juniper Junos OS (MX with SPC3 and SRX Series) cause a peer index rollover that ass
Web filtering bypass on Juniper Networks Junos OS MX Series exposes downstream resources to unauthenticated network atta
Denial-of-service in Juniper Networks Junos OS and Junos OS Evolved on EX Series, QFX Series, and MX Series allows a loc
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today