EUVD-2026-42711
GHSA-8p3c-wvj4-2gqc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:X/RE:M/U:X
Unauthenticated network-reachable packet triggers a crash with no user interaction (AV:N/AC:L/PR:N/UI:N); only availability is affected (A:H) with no confidentiality or integrity loss.
Primary rating from Vendor (juniper).
CVSS VectorVendor: juniper
Lifecycle Timeline
6DescriptionCVE.org
An Improper Validation of Specified Quantity in Input vulnerability in the TCP proxy plugin of Juniper Networks Junos OS on MX Series with SPC3, and SRX Series allows an unauthenticated, network-based attacker to cause a complete Denial of Service (DoS).
When TCP proxy is engaged in a flow session, to support ALGs, Advanced Anti-Malware, ICAP or UTM, a TCP packet with specifically malformed TCP header will cause flow processing daemon (flowd) to crash and restart. This causes a complete service outage until the system has automatically recovered.
This issue affects Junos OS on MX with SPC3, and SRX Series:
- 23.4 versions before 23.4R2-S7,
- 24.2 versions before 24.2R2-S4,
- 24.4 versions before 24.4R2-S3,
- 25.2 versions before 25.2R2.
This issue does not affect releases before 23.4R1.
Articles & Coverage 2
AnalysisAI
Remote denial of service in Juniper Networks Junos OS on MX Series (with SPC3) and SRX Series firewalls lets an unauthenticated network attacker crash the flow processing daemon (flowd) by sending a single TCP packet with a malformed TCP header when the TCP proxy is active. Because TCP proxy is engaged whenever ALGs, Advanced Anti-Malware, ICAP, or UTM services inspect a flow, exploitation forces a complete traffic-forwarding outage until the daemon auto-restarts. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a credible availability threat to perimeter devices.
Technical ContextAI
The flaw sits in the TCP proxy plugin of Junos flowd, the userspace/dataplane daemon that handles stateful flow processing on SRX firewalls and MX with the SPC3 services card. TCP proxy is a man-in-the-middle TCP termination mechanism the platform transparently inserts when Layer 7 security services (Application Layer Gateways, Advanced Anti-Malware/ATP, ICAP redirect, or Unified Threat Management) need to reassemble and inspect a session. The root cause is CWE-1284, Improper Validation of Specified Quantity in Input: a length/quantity field within the TCP header is not properly validated before use, so a specifically malformed header drives flowd into a fault and forced restart. The single affected CPE (cpe:2.3:a:juniper_networks:junos_os) understates scope, since the real constraint is the hardware line (MX/SPC3, SRX) plus the enabled proxy feature rather than the OS alone.
RemediationAI
Vendor-released patch: upgrade to Junos OS 23.4R2-S7, 24.2R2-S4, 24.4R2-S3, 25.2R2, or any later release per Juniper advisory JSA110083 (https://supportportal.juniper.net/JSA110083). Where immediate patching is not possible, the most effective compensating control is to determine whether TCP proxy is actually engaged and, if the affected Layer 7 services (ALGs, Advanced Anti-Malware/ATP, ICAP redirect, UTM) are not required, disabling them removes the vulnerable code path - the trade-off is loss of that content inspection capability. If those services must stay enabled, restrict which sources can reach the affected flows using firewall filters/access lists on the transit and self interfaces to limit exposure to trusted networks, accepting that this narrows but does not eliminate the attack surface. Monitor for repeated flowd restarts as an indicator of attempted exploitation.
Denial-of-service in Juniper Networks Junos OS on MX Series (with SPC3) and SRX Series devices allows an unauthenticated
Privilege escalation in Juniper Networks Junos OS allows high-privileged local attackers to gain root access on Linux-ba
Denial-of-service in the Packet Forwarding Engine (PFE) of Juniper Junos OS on MX (with SPC3) and SRX-series firewalls l
Denial-of-service in Juniper Networks Junos OS on SRX Series devices lets an unauthenticated, network-based attacker exh
Denial-of-service in Juniper Networks Junos OS on EX Series switches (EX2300, EX3400, EX4000, EX4100, EX4400) lets a low
Denial-of-service in Juniper Junos OS on EX4100 and EX4400 Series switches allows an unauthenticated adjacent attacker t
Denial-of-service in Juniper Networks Junos OS on QFX10000 Series switches allows an unauthenticated, adjacent (Layer 2)
Denial-of-service in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series routers lets an unauth
Out-of-bounds write in the Juniper Networks Junos OS http-gatekeeper (http-gk) process on SRX Series firewalls crashes t
Repeated IKE negotiation failures on Juniper Junos OS (MX with SPC3 and SRX Series) cause a peer index rollover that ass
Web filtering bypass on Juniper Networks Junos OS MX Series exposes downstream resources to unauthenticated network atta
Denial-of-service in Juniper Networks Junos OS and Junos OS Evolved on EX Series, QFX Series, and MX Series allows a loc
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today