Junos OS MX Series SPC3 leaks NAT resources on malformed IPv6 packets
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
Juniper Junos OS on MX Series with SPC3 is affected in versions before 23.2R2-S4, 23.4 before 23.4R2-S5, and 24.2 before 24.2R2. The Packet Forwarding Engine does not drop a specific malformed IPv6 packet in source NAT configurations, so it creates a session and allocates NAT resources (CWE-754). An unauthenticated remote attacker who keeps sending such packets exhausts sessions and NAT resources, stopping all traffic through the device until it is rebooted.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series with SPC3 allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). On MX Series with SPC3 line-card and source NAT configuration, when a specific malformed IPv6 packet is received, it is not dropped but instead a session is created and NAT resources are allocated. Continued receipt of such packets will eventually lead to session or resource exhaustion, which will impact all traffic through the device. To recover the device needs to be rebooted. To monitor session usage, use the following: show services sessions summary To monitor source NAT resource usage, use the following: show services nat pool This issue affects Junos OS on MX Series with SPC3: * All versions before 23.2R2-S4; * 23.4 versions before 23.4R2-S5; * 24.2 versions before 24.2R2.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Juniper | Junos OS | before 23.2R2-S4; 23.4 to before 23.4R2-S5; 24.2 to before 24.2R2 | 23.2R2-S4, 23.4R2-S5, 24.2R2 | Patch available | CNA |
- Junos OS VendorJuniper Affected before 23.2R2-S4; 23.4 to before 23.4R2-S5; 24.2 to before 24.2R2 Fixed in 23.2R2-S4, 23.4R2-S5, 24.2R2 Patch available CNA
Remediation
Junos OS fixed versions are 23.2R2-S4, 23.4R2-S5 and 24.2R2.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA Junos OS (Juniper Networks) Fixed in 23.2R2-S4, 23.4R2-S5, 24.2R2
Timeline
- 2026-10-15 Threatist record created from CVE-2026-102077
References
More Juniper vulnerabilities
- TI-2023-18638 Junos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthenticated to… KEVCVSS 3.1CRITICAL 9.8
- TI-2020-01585 Out of Cycle Security Advisory: Junos OS: Security vulnerability in J-Web and web based (HTTP/HTTPS) services KEVCVSS 3.1CRITICAL 9.8
- TI-2015-06436 Juniper ScreenOS 6.2.0r15 through 6.2.0r18, 6.3.0r12 before 6.3.0r12b, 6.3.0r13 before… KEVCVSS 3.1CRITICAL 9.8
- TI-2022-20885 Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults CVSS 3.1CRITICAL 9.8
- TI-2015-04610 Assertion failure in ISC BIND named via TKEY queries KEVCVSS 3.1HIGH 7.5
- TI-2025-15550 Junos OS: An local attacker with shell access can execute arbitrary code KEVCVSS 4.0MEDIUM 6.7
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences