EUVD-2026-101410
GHSA-699j-9vw9-9rmg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach IPv6 interface of MX/SPC3 router
-
DeliverySend crafted malformed IPv6 packets
-
ExploitPFE wrongly creates session, allocates NAT resource
-
ExecutionSustain packet flood to exhaust pool
-
PersistSession/NAT resource exhaustion
-
ImpactAll transit traffic dropped, reboot required
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Unusual condition handling
|
| Exploitation Conditions | Exploitation requires the target to be a Juniper MX Series device fitted with an SPC3 services line-card AND configured for source NAT; only under this combination does the PFE fail to drop the malformed IPv6 packet and instead allocate a session/NAT resource. The attack is further specific to IPv6 traffic and malformed packets reaching the NAT-processing path. It is remote and unauthenticated (PR:N/UI:N) with no user interaction, but is LIMITED by the non-default hardware (SPC3) and configuration (source NAT) prerequisites - devices without SPC3 or not performing source NAT are not affected. Impact is availability-only (resource/session exhaustion requiring a reboot), with no path to code execution or data access. |
| Impact | This is a credible operational-availability risk for a specific deployment profile, but not a universal emergency. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms a network-reachable, low-complexity, unauthenticated attack, and the impact metrics (VA:H with SA:L) correctly capture that the primary damage is availability - exhaustion of NAT/session resources that degrades ALL traffic through the device until a reboot. There is no confidentiality or integrity impact (VC:N/VI:N). The strongest mitigating signal is that exploitation is gated on a non-default condition: the device must be an MX Series chassis equipped with an SPC3 line-card AND configured for source NAT. No EPSS score, POC, or CISA KEV status was provided, so there is no evidence of active exploitation or weaponized code - the maturity sub-metric in the vendor vector is E:X (not defined). Net: treat as a high-priority patch for MX/SPC3 operators running source NAT (especially IPv6-facing edges/CGNAT), but materially lower urgency for environments lacking that line-card or NAT configuration. No signals are directly conflicting; the main caveat is that the 8.7 score reflects the full 4.0 environmental-capable scale and the real risk is bounded by the source-NAT precondition. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a stream of specially crafted malformed IPv6 packets toward an Internet-facing MX Series router running SPC3 with source NAT. Instead of dropping the malformed packets, the PFE creates a session and allocates NAT resources for each, so sustained transmission progressively exhausts session tables or NAT pool resources, eventually disrupting all traffic through the device and requiring a reboot to recover. No public exploit code is identified at time of analysis, but the attack requires only the ability to route IPv6 packets to the target and no authentication. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Denial of service in Juniper Networks Junos OS on MX Series routers equipped with SPC3 services line cards and configured for source NAT: the Packet Forwarding Engine fails to drop a specific malformed IPv6 packet and instead creates a session and allocates NAT resources, so sustained delivery of such packets exhausts the session/NAT pool and disrupts all traffic through the device until it is rebooted. The issue is remotely reachable and unauthenticated (no credentials and no user interaction required), and availability-only - there is no path to code execution or data disclosure. Exploitation is constrained by two non-default prerequisites, namely SPC3 hardware and an active source NAT configuration, and no public exploit code has been identified at time of analysis; impact is limited to the affected device profile, so this is a targeted operational-availability risk rather than a universal emergency.
RemediationAI
Vendor-released patches are available: upgrade Junos OS on MX Series with SPC3 to 23.2R2-S4, 23.4R2-S5, or 24.2R2 (or a later release on the respective branch) per Juniper advisory JSA112182 at https://supportportal.juniper.net/JSA112182. Where an immediate upgrade is not possible, reduce exposure in the NAT path: block or rate-limit malformed IPv6 traffic destined to the services/NAT plane with an ingress IPv6 filter or firewall term ahead of source NAT processing, noting this adds filter overhead and requires an accurate packet signature to avoid dropping legitimate traffic; where source NAT is not operationally essential, disabling it removes the vulnerable code path entirely at the cost of losing address/port translation for subscriber or egress traffic; and constrain the blast radius by limiting which interfaces and peers can reach the NAT-processing path. For monitoring and early warning, track the pools with 'show services sessions summary' and 'show services nat pool' so rising session or NAT resource consumption can be detected and the device rebooted before complete traffic loss, accepting that such a reboot is disruptive and only a recovery measure, not a fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw sits in the Packet Forwarding Engine (PFE) of Junos OS running on MX Series platforms fitted with an SPC3 services line card, and is classified as CWE-754, Improper Check for Unusual or Exceptional Conditions - the forwarding/NAT path processes a specific malformed IPv6 packet without validating or discarding it, so instead of being dropped the packet triggers stateful session creation and source NAT resource allocation. Because source NAT (address/port translation) inherently consumes scarce session-table entries and port/address pool resources, repeating the malformed packet drives the session and NAT pool to exhaustion, degrading all traffic traversing the device rather than only the offending flow, and recovery requires a reboot. Both the CVE record (CVSS 4.0 8.7, AV:N/AC:L/AT:N/PR:N/UI:N, VA:H with SA:L, availability-only) and the independent assessment (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) agree on a high-availability, confidentiality- and integrity-neutral impact reached remotely without authentication. Affected products map to the Juniper Networks Junos OS CPE (cpe:2.3:a:juniper_networks:junos_os), and the CWE-754 root cause explains why this is a missing-exception-check bug in packet handling rather than a memory-safety issue.
Know when Junos Os gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:U/RE:M
Remote unauthenticated malformed-packet flood (AV:N/AC:L/PR:N/UI:N) with availability-only impact (A:H, C:N/I:N); scope unchanged as the same device's traffic forwarding is degraded.
Primary rating from Vendor (juniper).
CVSS VectorVendor: juniper
Lifecycle Timeline
3DescriptionCVE.org
An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series with SPC3 allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).
On MX Series with SPC3 line-card and source NAT configuration, when a specific malformed IPv6 packet is received, it is not dropped but instead a session is created and NAT resources are allocated. Continued receipt of such packets will eventually lead to session or resource exhaustion, which will impact all traffic through the device. To recover the device needs to be rebooted. To monitor session usage, use the following:
show services sessions summary
To monitor source NAT resource usage, use the following:
show services nat pool
This issue affects Junos OS on MX Series with SPC3:
- All versions before 23.2R2-S4;
- 23.4 versions before 23.4R2-S5;
- 24.2 versions before 24.2R2.
Executive ViewAI
A high-severity denial-of-service vulnerability affects Juniper Networks MX Series routers equipped with SPC3 services line cards and configured for source NAT, allowing remote attackers to exhaust NAT resources and disrupt all network traffic until a reboot is performed. This poses a significant operational risk for organizations relying on these routers for critical connectivity, as a successful attack could cause extended network outages. Leadership should prioritize patching affected devices, though the attack requires specific hardware and configuration and no public exploit code has been identified.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
OS command injection in the phcd phone-home daemon of Juniper Networks Junos OS and Junos OS Evolved lets an adjacent, u
Unauthenticated remote code execution with root privileges affects Juniper Networks Junos OS devices that expose the J-W
Heap-based buffer overflow in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allow
A stack-based buffer overflow in the srxpfe packet forwarding process of Juniper Networks Junos OS on SRX Series devices
Unauthenticated remote code execution with elevated privileges is possible in Juniper Junos OS and Junos OS Evolved thro
Remote root code execution in the routing protocol daemon (rpd) of Juniper Junos OS is reachable through protocol-valid
Remote code execution (on Junos OS) and rpd denial of service (on Junos OS and Junos OS Evolved) result from a stack-bas
Remote code execution with root privileges on Juniper Networks Junos OS and Junos OS Evolved is possible when the routin
Remote code execution and denial of service in Juniper Networks Junos OS and Junos OS Evolved arise from a stack-based b
Unauthenticated remote attackers can gain root-level configuration access and fully compromise Juniper Junos OS and Juno
Integer underflow in the Junos OS kernel can crash a device when the Extended Echo feature (RFC 8335 ICMP probing) is co
Heap-based buffer overflow in Juniper Networks Junos OS on SRX Series devices that have Secure Vector Routing (SVR) enab
Exploit-DB