Junos OS CVE-2026-57030

Exploitation targets the stateful flow session teardown path on SRX Series devices, so the device must be actively performing stateful traffic processing (the normal SRX firewall mode) and be reachable by attacker-influenced network traffic - no authentication and no user interaction are required (PR:N/UI:N). The decisive limiting factor is the Attack Requirement (AT:P): the race triggers only under timing conditions the description explicitly states are outside the attacker's control, so the attacker can raise the odds with high flow-churn traffic but cannot deterministically force the mis-set timeout. Further limits: only Junos OS SRX trains 24.2 (before 24.2R2-S3), 24.4 (before 24.4R2-S1/S2), and 25.2 (before 25.2R1-S2/25.2R2) are affected, and releases earlier than 24.2R1 are not vulnerable at all.

The CVSS 4.0 base of 8.2 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L) reflects a network-reachable, unauthenticated availability-only impact - no confidentiality or integrity effect - with an explicit Attack Requirement (AT:P) capturing that the race is non-deterministic and its conditions are outside attacker control. That AT:P is the single most important tempering signal: an attacker can drive traffic to increase the odds of hitting the race but cannot reliably force it, so this is a probabilistic soak-style DoS rather than a single-shot crash. No EPSS score, KEV entry, POC, or SSVC decision was provided, so exploitation-likelihood signals are absent rather than low - treat that as unknown, not benign. Note also a data conflict: the input Tags list 'Information Disclosure', but the description, CWE-362, and the CVSS vector (VC:N) all indicate pure availability impact with no disclosure - the tag appears to be mislabeled and should be disregarded in favor of the DoS classification. Net: a genuine availability priority for exposed SRX perimeter devices, but the AT:P requirement and lack of a controllable trigger make it lower-urgency than a deterministic unauthenticated crash.

An attacker on the network path sends sustained, high-churn traffic (many short-lived connections that rapidly establish and tear down flows) through an exposed SRX device to maximize the probability of triggering the flow-teardown race. Over time some flows get the erroneous multi-thousand-second timeout and are never reaped, so invalidated sessions accumulate until the PFE stops forwarding or flowd cores and the box reboots. No POC or exploit code is publicly identified, and success is probabilistic rather than guaranteed given the network vector with attack requirements (AV:N/AC:L/AT:P).