EUVD-2026-42719
GHSA-6hx5-3rjf-rm36
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:M/U:X
Network-reachable and unauthenticated (AV:N/PR:N/UI:N) but the race is non-deterministic and outside attacker control, so AC:H; impact is availability-only (A:H, C/I:N) on the device itself (S:U).
Primary rating from Vendor (juniper).
CVSS VectorVendor: juniper
Lifecycle Timeline
4DescriptionCVE.org
A Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).
As part of the stateful traffic processing on SRX Series devices flows are being established, and removed when not needed anymore. During the removal process the timeout of a flow should be set to 3 seconds and consequentially the flow should be removed shortly after. Due to a race condition occurring when setting the timeout there is a chance (the exact conditions are outside the attackers control) that the timeout is instead set to a very high value of larger than 10,000 seconds:
user@host> show security flow session | match timeout Session ID: 98784248524, Policy name: PROD-FLOW/4, HA State: Active, Timeout: 85250, Session State: Valid
This will lead to an accumulation of flows which can be observed by an ever-increasing value of invalidated sessions in the output of 'show security flow session summary':
user@host> show security flow session summary | match invalid Invalidated sessions: 216931These sessions can't be cleared manually with the 'clear security flow session' command, which will either lead to forwarding to stop (and the system needs to be manually recovered with a reboot) or to a flowd core and automatic reboot.
This issue affects Junos OS on SRX Series:
- 24.2 versions before 24.2R2-S3,
- 24.4 versions before 24.4R2-S1, 24.4R2-S2,
- 25.2 versions before 25.2R1-S2, 25.2R2.
This issue does not affect releases earlier than 24.2R1;
Articles & Coverage 2
AnalysisAI
Denial-of-service in Juniper Networks Junos OS on SRX Series devices lets an unauthenticated, network-based attacker exhaust the packet forwarding engine (PFE) by exploiting a race condition in stateful flow teardown. When the race is hit, a flow's timeout is mis-set to a very high value (>10,000s instead of 3s), so sessions are never reaped, invalidated sessions accumulate without bound, and the device eventually stops forwarding or hits a flowd core and reboots. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; exploitation is probabilistic because the triggering conditions are outside the attacker's control.
Technical ContextAI
The root cause is CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization / Race Condition) inside the SRX flow daemon (flowd) running on the PFE. SRX is a stateful firewall/router: for each session it maintains a flow table and ages entries out via per-flow timeouts. During flow removal the code intends to set the timeout to 3 seconds so the entry is quickly garbage-collected, but concurrent access to the timeout field lets a stale/large value (e.g., 85250 seconds observed in 'show security flow session') win the write. Because the affected value governs table cleanup, the leaked entries appear as an ever-growing 'Invalidated sessions' counter in 'show security flow session summary' and cannot be freed with 'clear security flow session'. Per the supplied CPE (cpe:2.3:a:juniper_networks:junos_os) the affected component is Junos OS, specifically the SRX Series flow processing path.
RemediationAI
Vendor-released patch: upgrade Junos OS on SRX to a fixed release - 24.2R2-S3, 24.4R2-S1 or 24.4R2-S2, or 25.2R1-S2 or 25.2R2 (or later on each train), per Juniper advisory JSA110090 (https://supportportal.juniper.net/JSA110090). There is no configuration workaround that removes the race itself, so upgrading is the only true fix; as an operational compensating control, proactively monitor 'show security flow session summary' for a steadily climbing 'Invalidated sessions' counter and watch for high per-flow timeout values in 'show security flow session', since affected sessions cannot be cleared with 'clear security flow session'. When accumulation is detected, a controlled reboot recovers forwarding before the device fails on its own - schedule it during a maintenance window because a reboot is service-affecting, and where possible fail over to an HA cluster peer first to avoid an unplanned flowd-core-induced reboot. Restricting untrusted traffic that establishes and tears down large volumes of short-lived flows can reduce how quickly the condition is reached but does not prevent it.
Denial-of-service in Juniper Networks Junos OS on MX Series (with SPC3) and SRX Series devices allows an unauthenticated
Remote denial of service in Juniper Networks Junos OS on MX Series (with SPC3) and SRX Series firewalls lets an unauthen
Privilege escalation in Juniper Networks Junos OS allows high-privileged local attackers to gain root access on Linux-ba
Denial-of-service in the Packet Forwarding Engine (PFE) of Juniper Junos OS on MX (with SPC3) and SRX-series firewalls l
Denial-of-service in Juniper Networks Junos OS on EX Series switches (EX2300, EX3400, EX4000, EX4100, EX4400) lets a low
Denial-of-service in Juniper Junos OS on EX4100 and EX4400 Series switches allows an unauthenticated adjacent attacker t
Denial-of-service in Juniper Networks Junos OS on QFX10000 Series switches allows an unauthenticated, adjacent (Layer 2)
Denial-of-service in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series routers lets an unauth
Out-of-bounds write in the Juniper Networks Junos OS http-gatekeeper (http-gk) process on SRX Series firewalls crashes t
Repeated IKE negotiation failures on Juniper Junos OS (MX with SPC3 and SRX Series) cause a peer index rollover that ass
Web filtering bypass on Juniper Networks Junos OS MX Series exposes downstream resources to unauthenticated network atta
Denial-of-service in Juniper Networks Junos OS and Junos OS Evolved on EX Series, QFX Series, and MX Series allows a loc
Same weakness CWE-362 – Race Condition
View allSame technique Race Condition
View allShare
External POC / Exploit Code
Leaving vuln.today