CVE-2026-101938 in Junos OS
Summary
by MITRE • 10/14/2026
An Integer Underflow (Wrap or Wraparound) vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an adjacent unauthenticated attacker to cause a forwarding-plane denial of service via an ICMP message associated with an SVR carrier session.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The identified vulnerability represents a critical security flaw within the Secure Routing Platform Forwarding Engine, commonly referred to as srxpfe, which serves as the core data plane component in Juniper Networks SRX Series devices running Junos OS and Junos OS Evolved. This specific weakness is classified under CWE-192, known as Integer Underflow or Wraparound, a category of software errors that occurs when an arithmetic operation results in a value smaller than the minimum representable integer for its data type. In this context, the flaw manifests during the processing of Internet Control Message Protocol (ICMP) messages associated with Stateful Virtual Router (SVR) carrier sessions. The SVR feature allows multiple virtual routers to share physical interfaces and forwarding resources while maintaining separate routing tables and security policies, a common architecture in service provider environments for network isolation and multi-tenancy.
The technical root cause lies in the handling of packet metadata or sequence numbers within the srxpfe when processing ICMP traffic destined for or originating from an SVR carrier session. When an adjacent unauthenticated attacker sends a specifically crafted ICMP message, the forwarding engine fails to properly validate integer bounds before performing arithmetic operations on associated counters or offsets. This lack of validation leads to an underflow condition where the calculated value wraps around to a large positive number instead of remaining within expected negative or zero ranges. Such miscalculations can corrupt internal data structures used for session tracking, buffer management, or flow classification within the forwarding plane. Because this processing occurs in the high-performance hardware-accelerated path rather than the control plane, the error propagates rapidly through the system's packet handling logic without triggering standard software exception handlers that might otherwise isolate the fault.
The operational impact of this vulnerability is severe, primarily resulting in a denial of service for the affected device and potentially adjacent network segments depending on the specific failure mode triggered by the underflow. The corruption of internal forwarding structures can cause the srxpfe to enter an unstable state, leading to packet drops, session teardowns, or in worst-case scenarios, a complete crash of the forwarding engine requiring a reboot of the chassis. Since the vulnerability allows exploitation by an adjacent unauthenticated attacker, it poses a significant risk in environments where devices are connected on shared broadcast domains such as LAN segments, management networks, or direct peer-to-peer links without intermediate firewalls. An adversary with local network access can exploit this flaw to disrupt critical routing and security functions, effectively neutralizing the device's ability to inspect traffic, enforce policies, or maintain connectivity for legitimate users.
From a threat intelligence perspective, this vulnerability aligns with MITRE ATT&CK technique T1498, Network Denial of Service, specifically sub-technique T1498.003 which involves flooding or exploiting protocol weaknesses to degrade service availability. The attack vector is classified as Adjacent because it requires the attacker to be on the same network segment as the target device, limiting remote exploitation over wide area networks but making it highly dangerous in local access scenarios such as compromised endpoints within a corporate LAN or unauthorized devices plugged into switch ports. This constraint means that while the severity is high due to the unauthenticated nature of the attack and the criticality of the affected component, the scope of immediate risk is geographically bounded by network topology unless other vulnerabilities exist that allow lateral movement from remote positions.
Mitigation strategies must focus on both technical remediation and architectural defense in depth. The primary solution is to apply the vendor-provided software patches or updates released by Juniper Networks for the affected versions of Junos OS and Junnos OS Evolved, which correct the integer validation logic within the srxpfe module. Until patching can be performed, network segmentation should be enforced to prevent untrusted hosts from reaching devices running vulnerable firmware. Implementing strict access control lists on adjacent interfaces to filter ICMP traffic or rate-limit such messages can reduce the likelihood of triggering the underflow condition. Additionally, enabling logging for abnormal packet drops or session anomalies may aid in detecting exploitation attempts and facilitating rapid incident response. Regular vulnerability scanning focused on network infrastructure components is essential to identify devices running unpatched versions before they are targeted by opportunistic attackers leveraging this specific flaw.