Session Smart Router EUVD-2026-112227

Exploitation requires network access to the HTTP interface served by the HttpParser component on Juniper Session Smart Router or Session Smart Conductor; per the CVSS vector no authentication (PR:N) and no user interaction (UI:N) are needed, so any attacker able to reach that HTTP listener can send the crafted request. The trigger mechanism beyond 'a specially crafted HTTP request' is not described in the available sources. Limiting factors: impact is confined to denial of service (A:L only - no code execution, no data exposure per C:N/I:N), and exploitation depends on the HTTP service being network-reachable from the attacker, so deployments that restrict management/HTTP interface exposure materially reduce the realistic attack surface.

This is a moderate-severity availability issue, not a high-priority emergency. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, score 5.3) indicates a remotely reachable, low-complexity, unauthenticated flaw, but the only impact is partial availability loss (A:L) - no confidentiality or integrity impact, consistent with an out-of-bounds read (CWE-125) that crashes or degrades the HttpParser rather than leaking data or executing code. The vuln.today decision label is 'this_month', signaling routine patching urgency rather than act_now/emergency. No EPSS score, no CISA KEV listing, and no public exploit reference were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Exploitation status, EPSS, and KEV signals are all absent/negative, which aligns with the modest CVSS and the 'this_month' decision - the signals are consistent, pointing to a real but non-urgent DoS risk. Note one tension between metadata and the vector: the input Tags include 'Information Disclosure' and 'Buffer Overflow', yet the CVSS vector sets C:N and the description cites only an out-of-bounds read causing denial of service, so the information-disclosure characterization is not supported by the available vector or description and should be treated as unconfirmed.

A remote attacker with network reachability to the SSR or Conductor HTTP service sends a specially crafted HTTP request that triggers an out-of-bounds read in the HttpParser component, crashing or degrading the service and denying availability to legitimate users. No authentication or user interaction is required per the CVSS vector. No public exploit identified at time of analysis.