EUVD-2026-42711
GHSA-8p3c-wvj4-2gqc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach firewall over network
-
DeliverySend malformed TCP header into proxied session
-
ExploitFail input-quantity validation in flowd
-
ExecutionCrash flow processing daemon
-
ImpactComplete forwarding outage until auto-restart
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V2 - Validation and Business Logic Input size validation
|
| Exploitation Conditions | Exploitation requires that the Junos TCP proxy be actively engaged in the target flow session, which occurs only when the device is configured for one of ALG (Application Layer Gateway), Advanced Anti-Malware (AAMW/ATP), ICAP redirect, or UTM inspection - if none of these L7 services touch the traffic, TCP proxy is not inserted and the flaw is not reachable. The device must be an MX Series with an SPC3 card or an SRX Series running an affected version (23.4R1 through the fixed builds listed); releases before 23.4R1 are not affected. Limiting factors: no authentication, user interaction, or non-default trigger beyond the proxy feature is needed once L7 inspection is on, but the platform automatically recovers after each crash (R:A), so impact is a repeatable transient outage rather than a permanent takedown. |
| Impact | The CVSS 4.0 base score is 8.7 (High) with vector AV:N/AC:L/AT:N/PR:N/UI:N and impact confined to availability (VA:H, SA:L) - no confidentiality or integrity loss. All exploitability signals point toward easy triggering: network reachable, low complexity, no authentication, no user interaction. Tempering that, the vector notes automatic recovery (R:A) and the practical precondition that TCP proxy must actually be engaged, which requires ALG/AAMW/ICAP/UTM to be configured - not a universal default. This is a genuine availability priority for organizations running L7 inspection on their SRX/MX perimeter, but a low-value target for attackers seeking persistence or data theft since the box self-heals. EPSS score was not provided, so probabilistic exploitation likelihood is unknown; there is no KEV listing and no POC signal, suggesting this is a patch-on-normal-cadence item unless the affected features are in use on internet-facing devices, where it rises to urgent. |
| Exploit ScenarioDerived | An attacker on any network path to an SRX or MX/SPC3 firewall that is inspecting traffic with UTM, AAMW, ICAP, or an ALG sends a single TCP packet crafted with a malformed header field into a proxied session. flowd fails validation and crashes, dropping all flow-based forwarding until it automatically restarts, and the attacker can repeat the packet to sustain the outage. No public exploit code has been identified, but the low complexity and absence of authentication make weaponization straightforward. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jul 09, 2026
Remote denial of service in Juniper Networks Junos OS on MX Series (with SPC3) and SRX Series firewalls lets an unauthenticated network attacker crash the flow processing daemon (flowd) by sending a single TCP packet with a malformed TCP header when the TCP proxy is active. Because TCP proxy is engaged whenever ALGs, Advanced Anti-Malware, ICAP, or UTM services inspect a flow, exploitation forces a complete traffic-forwarding outage until the daemon auto-restarts. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a credible availability threat to perimeter devices.
Earlier versions of this analysis (2)
Denial of service in Juniper Networks Junos OS on MX Series (with SPC3) and SRX Series lets an unauthenticated, network-based attacker crash the flow processing daemon (flowd) by sending a single TCP packet with a malformed TCP header when the TCP proxy is active. The crash-and-restart produces a complete traffic-forwarding outage until the device auto-recovers, and the packet can be replayed to sustain the outage. No public exploit is identified at time of analysis, and it is not listed in CISA KEV, but the CVSS 4.0 base score of 8.7 and lack of authentication make it a high-priority patching item for exposed edge/security appliances.
Remote denial-of-service in Juniper Junos OS on MX Series (with SPC3) and SRX Series lets an unauthenticated network attacker crash the flow processing daemon (flowd) by sending a single TCP packet with a malformed header when the TCP proxy is active. Because TCP proxy is engaged to support ALGs, Advanced Anti-Malware, ICAP, or UTM, environments running these security services are exposed to a complete service outage until the device auto-recovers. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS data was not provided.
RemediationAI
Vendor-released patch: upgrade to Junos OS 23.4R2-S7, 24.2R2-S4, 24.4R2-S3, 25.2R2, or any later release per Juniper advisory JSA110083 (https://supportportal.juniper.net/JSA110083). Where immediate patching is not possible, the most effective compensating control is to determine whether TCP proxy is actually engaged and, if the affected Layer 7 services (ALGs, Advanced Anti-Malware/ATP, ICAP redirect, UTM) are not required, disabling them removes the vulnerable code path - the trade-off is loss of that content inspection capability. If those services must stay enabled, restrict which sources can reach the affected flows using firewall filters/access lists on the transit and self interfaces to limit exposure to trusted networks, accepting that this narrows but does not eliminate the attack surface. Monitor for repeated flowd restarts as an indicator of attempted exploitation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw sits in the TCP proxy plugin of Junos flowd, the userspace/dataplane daemon that handles stateful flow processing on SRX firewalls and MX with the SPC3 services card. TCP proxy is a man-in-the-middle TCP termination mechanism the platform transparently inserts when Layer 7 security services (Application Layer Gateways, Advanced Anti-Malware/ATP, ICAP redirect, or Unified Threat Management) need to reassemble and inspect a session. The root cause is CWE-1284, Improper Validation of Specified Quantity in Input: a length/quantity field within the TCP header is not properly validated before use, so a specifically malformed header drives flowd into a fault and forced restart. The single affected CPE (cpe:2.3:a:juniper_networks:junos_os) understates scope, since the real constraint is the hardware line (MX/SPC3, SRX) plus the enabled proxy feature rather than the OS alone.
Know when Junos Os gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/RE:M
Unauthenticated network-reachable packet triggers a crash with no user interaction (AV:N/AC:L/PR:N/UI:N); only availability is affected (A:H) with no confidentiality or integrity loss.
Primary rating from Vendor (juniper).
CVSS VectorVendor: juniper
Lifecycle Timeline
4DescriptionCVE.org
An Improper Validation of Specified Quantity in Input vulnerability in the TCP proxy plugin of Juniper Networks Junos OS on MX Series with SPC3, and SRX Series allows an unauthenticated, network-based attacker to cause a complete Denial of Service (DoS).
When TCP proxy is engaged in a flow session, to support ALGs, Advanced Anti-Malware, ICAP or UTM, a TCP packet with specifically malformed TCP header will cause flow processing daemon (flowd) to crash and restart. This causes a complete service outage until the system has automatically recovered.
This issue affects Junos OS on MX with SPC3, and SRX Series:
- 23.4 versions before 23.4R2-S7,
- 24.2 versions before 24.2R2-S4,
- 24.4 versions before 24.4R2-S3,
- 25.2 versions before 25.2R2.
This issue does not affect releases before 23.4R1.
Articles & Coverage 2
Executive ViewAI
Juniper Networks MX and SRX Series firewalls are vulnerable to an unauthenticated remote denial-of-service attack (CVE-2026-57023) that crashes the firewall's flow processing daemon, causing immediate traffic stoppage until automatic daemon restart occurs. Attackers can trigger repeated outages by sending single malformed TCP packets whenever security inspection services are active. The absence of available patches requires immediate implementation of mitigating controls to protect perimeter network availability.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable TCP proxy services on firewall inspection zones where Advanced Anti-Malware, ICAP, or UTM inspection are not operationally critical; (2) Implement strict ingress ACLs with rate limiting to constrain TCP header anomalies and reduce attack feasibility; (3) Configure redundant firewall appliances with active-passive or active-active failover to minimize outage window; (4) Deploy network segmentation to limit direct access to affected firewall platforms; (5) Establish real-time monitoring and alerting for flowd daemon restarts to detect exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
OS command injection in the phcd phone-home daemon of Juniper Networks Junos OS and Junos OS Evolved lets an adjacent, u
Unauthenticated remote code execution with root privileges affects Juniper Networks Junos OS devices that expose the J-W
Heap-based buffer overflow in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allow
A stack-based buffer overflow in the srxpfe packet forwarding process of Juniper Networks Junos OS on SRX Series devices
Unauthenticated remote code execution with elevated privileges is possible in Juniper Junos OS and Junos OS Evolved thro
Remote root code execution in the routing protocol daemon (rpd) of Juniper Junos OS is reachable through protocol-valid
Remote code execution (on Junos OS) and rpd denial of service (on Junos OS and Junos OS Evolved) result from a stack-bas
Remote code execution with root privileges on Juniper Networks Junos OS and Junos OS Evolved is possible when the routin
Remote code execution and denial of service in Juniper Networks Junos OS and Junos OS Evolved arise from a stack-based b
Unauthenticated remote attackers can gain root-level configuration access and fully compromise Juniper Junos OS and Juno
Integer underflow in the Junos OS kernel can crash a device when the Extended Echo feature (RFC 8335 ICMP probing) is co
Heap-based buffer overflow in Juniper Networks Junos OS on SRX Series devices that have Secure Vector Routing (SVR) enab
Exploit-DB