EUVD-2026-101490
GHSA-m422-p9p5-2983
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain adjacent network position to SRX
-
ExploitSend crafted ICMP tied to SVR carrier session
-
ExecutionTrigger integer underflow in srxpfe
-
ImpactForwarding-plane denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer underflow checks
|
| Exploitation Conditions | Exploitation requires (1) network adjacency to the target SRX Series device (CVSS AV:A - the attacker must be on a directly connected/adjacent L2 or logical segment, not arbitrary Internet reach), and (2) the device processing an ICMP message associated with an SVR (Secure Vector Routing) carrier session, implying SVR/carrier-session functionality must be in use on the Junos OS or Junos OS Evolved SRX deployment. No authentication (PR:N) and no user interaction (UI:N) are needed. The primary limiting factors are the adjacency requirement and the dependence on SVR carrier-session traffic handling, so devices not configured for or exposed to SVR carrier sessions, or isolated from untrusted adjacent segments, face reduced realistic risk. |
| Impact | This is a moderate-priority availability issue rather than a top-tier emergency. The vendor CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) describes an adjacent, low-complexity, unauthenticated attack with no user interaction, which lowers the bar for exploitation, but the AV:A constraint means the attacker must already be on an adjacent network segment (not a fully remote Internet-wide attack), meaningfully limiting the exposed population. Impact is availability-only (VC:N/VI:N/VA:H, with a minor subsequent SA:L) - a forwarding-plane denial of service on SRX Series devices - with no confidentiality or integrity loss, consistent with the 7.1 score. No EPSS probability, CISA KEV listing, POC reference, or SSVC automatable/exploitation data was supplied, so exploitation likelihood cannot be quantified from the inputs; treat the 7.1 as a severity ceiling, not evidence of active abuse. One cross-source note: the Tags list 'Integer Overflow' while the description and CWE-191 both specify an integer UNDERFLOW - the weakness class in the tag appears mislabeled relative to the authoritative description. |
| Exploit ScenarioDerived | An attacker positioned on an adjacent network segment to an SRX Series device sends a specially crafted ICMP message tied to an SVR (Secure Vector Routing) carrier session. The malformed message triggers an integer underflow in the srxpfe forwarding process, crashing or hanging the forwarding plane and disrupting traffic. No authentication or user interaction is required, but adjacency to the target is a prerequisite, and no public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
An integer underflow in the srxpfe forwarding-plane daemon of Junos OS and Junos OS Evolved on SRX Series firewalls allows an unauthenticated attacker on an adjacent network segment to trigger a denial of service by sending an ICMP message tied to an SVR (Secure Vector Routing) carrier session. Affected deployments are those running SVR/carrier-session functionality on SRX platforms, where successful exploitation degrades or halts packet forwarding; the CVSS 4.0 base score of 7.1 reflects high availability impact with no confidentiality or integrity loss (assessed CVSS 3.1: AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). There is no public exploit code and no confirmed active exploitation (no CISA KEV listing) at time of analysis, but the attack requires only Layer 2 adjacency and no credentials or user interaction, so any SRX device with SVR sessions reachable from an untrusted adjacent segment should be treated as exposed.
RemediationAI
Apply the fixed Junos OS or Junos OS Evolved release identified in Juniper advisory JSA112186 (https://supportportal.juniper.net/JSA112186); the intelligence provided does not name an exact patched version, so confirm the recommended release on the advisory's solution table for your SRX platform and Junos branch before upgrading, and note that the fix targets the srxpfe forwarding-plane component, so a full software install and device restart (not just a daemon restart) is typically required and will interrupt transit traffic. If immediate patching is not possible, the most effective compensating control is to remove the attack preconditions: disable or decommission SVR carrier sessions on the SRX if they are not operationally required, which eliminates the vulnerable ICMP parsing path but breaks the secure vector routing overlay and any peer tunnels depending on it. Where SVR must remain enabled, restrict adjacency - enforce strict L2/L3 boundary filtering so untrusted hosts cannot share a segment with the SRX, apply stateless firewall filters or host-inbound traffic policies to drop ICMP toward SVR carrier-session addresses from non-trusted zones, and monitor for forwarding-plane restarts or srxpfe crashes as indicators of attempted exploitation; each of these reduces but does not fully eliminate risk and adds operational overhead and potential management-plane reachability trade-offs.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-191 integer underflow (wrap or wraparound) in the srxpfe process, the userspace/packet-forwarding engine component that handles SRX data-plane traffic on Junos OS and Junos OS Evolved. When an ICMP message associated with an SVR carrier session is parsed, a size or counter value is decremented below its minimum, wrapping to a very large unsigned value that the forwarding path cannot safely handle, resulting in a data-plane (forwarding-plane) crash or hang rather than a control-plane compromise. SVR is Juniper's session-oriented, tunnel-free routing overlay that carries traffic between SRX peers over IPsec; the ICMP handling path for these carrier sessions is the specific attack surface. CPE data confirms the affected platforms are juniper_networks:junos_os and juniper_networks:junos_os_evolved, i.e. the vulnerability is platform-scoped to SRX Series hardware running those operating systems, and the adjacent-network vector in the CVSS 4.0 vector (AV:A, PR:N, UI:N, VA:H) aligns with the assessed CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - an availability-only issue reachable from a directly connected or logically adjacent segment.
Know when Junos Os gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M
Adjacent unauthenticated ICMP trigger (AV:A/AC:L/PR:N/UI:N) causing forwarding-plane DoS with availability-only impact (A:H), no scope change or C/I loss.
Primary rating from Vendor (juniper).
CVSS VectorVendor: juniper
Lifecycle Timeline
4DescriptionCVE.org
An Integer Underflow (Wrap or Wraparound) vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an adjacent unauthenticated attacker to cause a forwarding-plane denial of service via an ICMP message associated with an SVR carrier session.
Executive ViewAI
Juniper SRX Series firewalls running Junos OS with Secure Vector Routing (SVR) enabled are vulnerable to a denial-of-service condition that can degrade or halt packet forwarding. An unauthenticated attacker on an adjacent network segment can exploit this flaw without credentials or user interaction, potentially disrupting network connectivity for organizations relying on affected firewalls. With no vendor-released patch identified at time of analysis, leadership should prioritize immediate mitigations to protect critical network segments.
No vendor-released patch identified at time of analysis. Interim mitigations: disable SVR/carrier sessions if not required; restrict Layer 2 adjacency to trusted segments; apply firewall filters to drop ICMP messages associated with SVR from untrusted adjacent networks; monitor for forwarding plane instability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
OS command injection in the phcd phone-home daemon of Juniper Networks Junos OS and Junos OS Evolved lets an adjacent, u
Unauthenticated remote code execution with root privileges affects Juniper Networks Junos OS devices that expose the J-W
Heap-based buffer overflow in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allow
A stack-based buffer overflow in the srxpfe packet forwarding process of Juniper Networks Junos OS on SRX Series devices
Unauthenticated remote code execution with elevated privileges is possible in Juniper Junos OS and Junos OS Evolved thro
Remote root code execution in the routing protocol daemon (rpd) of Juniper Junos OS is reachable through protocol-valid
Remote code execution (on Junos OS) and rpd denial of service (on Junos OS and Junos OS Evolved) result from a stack-bas
Remote code execution with root privileges on Juniper Networks Junos OS and Junos OS Evolved is possible when the routin
Remote code execution and denial of service in Juniper Networks Junos OS and Junos OS Evolved arise from a stack-based b
Unauthenticated remote attackers can gain root-level configuration access and fully compromise Juniper Junos OS and Juno
Integer underflow in the Junos OS kernel can crash a device when the Extended Echo feature (RFC 8335 ICMP probing) is co
Heap-based buffer overflow in Juniper Networks Junos OS on SRX Series devices that have Secure Vector Routing (SVR) enab
Exploit-DB