Use after free in Junos OS on SRX Series can crash flowd
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-416 and the CVSS impact.
Summary
Junos OS on SRX Series versions before 23.2R2-S5, from 23.4 before 23.4R2-S6, from 24.2 before 24.2R2-S3, from 24.4 before 24.4R2-S1 and from 25.2 before 25.2R1-S1, 25.2R2 are affected. A use after free (CWE-416) in the packet forwarding engine lets an unauthenticated network attacker cause a denial of service. With web filtering for TCP traffic configured, a high volume of DNS requests makes a flowd crash and restart more likely, causing a full service outage.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
A Use After Free vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). When web filtering for TCP traffic is configured, a high volume of DNS requests increases the likelihood of a flowd crash and restart, which leads to a complete service outage until the service has automatically recovered. This is a race condition outside the attacker's direct control. This issue affects Junos OS on SRX Series: * All versions before 23.2R2-S5; * from 23.4 before 23.4R2-S6; * from 24.2 before 24.2R2-S3; * from 24.4 before 24.4R2-S1; * from 25.2 before 25.2R1-S1, 25.2R2.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Juniper | Junos OS | before 23.2R2-S5; 23.4 to before 23.4R2-S6; 24.2 to before 24.2R2-S3; 24.4 to before 24.4R2-S1; 25.2 to before 25.2R1-S1, 25.2R2 | 23.2R2-S5, 23.4R2-S6, 24.2R2-S3, 24.4R2-S1, 25.2R1-S1, 25.2R2 | Patch available | CNA |
- Junos OS VendorJuniper Affected before 23.2R2-S5; 23.4 to before 23.4R2-S6; 24.2 to before 24.2R2-S3; 24.4 to before 24.4R2-S1; 25.2 to before 25.2R1-S1, 25.2R2 Fixed in 23.2R2-S5, 23.4R2-S6, 24.2R2-S3, 24.4R2-S1, 25.2R1-S1, 25.2R2 Patch available CNA
Remediation
Upgrade Junos OS on SRX Series to 23.2R2-S5, 23.4R2-S6, 24.2R2-S3, 24.4R2-S1, 25.2R1-S1 or 25.2R2.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA Junos OS (Juniper Networks) Fixed in 23.2R2-S5, 23.4R2-S6, 24.2R2-S3, 24.4R2-S1, 25.2R1-S1, 25.2R2
Timeline
- 2026-10-15 Threatist record created from CVE-2026-102078
References
More Juniper vulnerabilities
- TI-2023-18638 Junos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthenticated to… KEVCVSS 3.1CRITICAL 9.8
- TI-2020-01585 Out of Cycle Security Advisory: Junos OS: Security vulnerability in J-Web and web based (HTTP/HTTPS) services KEVCVSS 3.1CRITICAL 9.8
- TI-2015-06436 Juniper ScreenOS 6.2.0r15 through 6.2.0r18, 6.3.0r12 before 6.3.0r12b, 6.3.0r13 before… KEVCVSS 3.1CRITICAL 9.8
- TI-2022-20885 Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults CVSS 3.1CRITICAL 9.8
- TI-2015-04610 Assertion failure in ISC BIND named via TKEY queries KEVCVSS 3.1HIGH 7.5
- TI-2025-15550 Junos OS: An local attacker with shell access can execute arbitrary code KEVCVSS 4.0MEDIUM 6.7
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences