Denial of service in Junos OS SRX Series via malformed TLS message
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
Junos OS on SRX Series is affected before 23.2R2-S5, from 23.4 before 23.4R2-S5, from 24.2 before 24.2R2-S2 and from 24.4 before 24.4R2. With ssl-proxy configured, a malformed TLS message received during TLS session resumption causes an invalid pointer access and a PFE crash (CWE-166). A network-based unauthenticated attacker can cause a denial of service, with traffic forwarding lost until the PFE recovers.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
An Improper Handling of Missing Special Element vulnerability in the SSL plugin of Juniper Networks Junos OS on SRX Series allows a network-based, unauthenticated attacker to cause a Denial-of-Service (DoS). This issue is will occur when 'ssl-proxy' is configured on SRX platforms and during a TLS session-resumption attempt a specifically malformed TLS message is received. This results in an invalid pointer access and PFE crash which causes a temporary loss of traffic forwarding until the PFE automatically recovers. The exact internal timing to trigger this issue is outside the attacker's direct control.This issue affects Junos OS on SRX Series: * All versions before 23.2R2-S5; * 23.4 versions before 23.4R2-S5; * 24.2 versions before 24.2R2-S2; * 24.4 versions before 24.4R2.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Juniper | Junos OS | before 23.2R2-S5; 23.4 to before 23.4R2-S5; 24.2 to before 24.2R2-S2; 24.4 to before 24.4R2 | 23.2R2-S5, 23.4R2-S5, 24.2R2-S2, 24.4R2 | Patch available | CNA |
- Junos OS VendorJuniper Affected before 23.2R2-S5; 23.4 to before 23.4R2-S5; 24.2 to before 24.2R2-S2; 24.4 to before 24.4R2 Fixed in 23.2R2-S5, 23.4R2-S5, 24.2R2-S2, 24.4R2 Patch available CNA
Remediation
Upgrade Junos OS on SRX Series to 23.2R2-S5, 23.4R2-S5, 24.2R2-S2 or 24.4R2, the fixed version for each release line.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA Junos OS (Juniper Networks) Fixed in 23.2R2-S5, 23.4R2-S5, 24.2R2-S2, 24.4R2
Timeline
- 2026-10-15 Threatist record created from CVE-2026-102082
References
More Juniper vulnerabilities
- TI-2023-18638 Junos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthenticated to… KEVCVSS 3.1CRITICAL 9.8
- TI-2020-01585 Out of Cycle Security Advisory: Junos OS: Security vulnerability in J-Web and web based (HTTP/HTTPS) services KEVCVSS 3.1CRITICAL 9.8
- TI-2015-06436 Juniper ScreenOS 6.2.0r15 through 6.2.0r18, 6.3.0r12 before 6.3.0r12b, 6.3.0r13 before… KEVCVSS 3.1CRITICAL 9.8
- TI-2022-20885 Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults CVSS 3.1CRITICAL 9.8
- TI-2015-04610 Assertion failure in ISC BIND named via TKEY queries KEVCVSS 3.1HIGH 7.5
- TI-2025-15550 Junos OS: An local attacker with shell access can execute arbitrary code KEVCVSS 4.0MEDIUM 6.7
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences