CVE-2026-102077 in Junos OS
Summary
by MITRE • 10/15/2026
An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series with SPC3 allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).
On MX Series with SPC3 line-card and source NAT configuration, when a specific malformed IPv6 packet is received, it is not dropped but instead a session is created and NAT resources are allocated. Continued receipt of such packets will eventually lead to session or resource exhaustion, which will impact all traffic through the device. To recover the device needs to be rebooted. To monitor session usage, use the following:
show services sessions summary
To monitor source NAT resource usage, use the following:
show services nat pool
This issue affects Junos OS on MX Series with SPC3:
* All versions before 23.2R2-S4; * 23.4 versions before 23.4R2-S5; * 24.2 versions before 24.2R2.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in the Packet Forwarding Engine of Juniper Networks Junos OS represents a critical flaw in input validation logic, specifically categorized under CWE-754: Improper Check for Unusual or Exceptional Conditions. This defect resides within the network processing pipeline responsible for handling source Network Address Translation operations on MX Series routers equipped with SPC3 line cards. The core technical failure occurs when the system receives a specific type of malformed IPv6 packet that violates expected protocol standards or internal state machine expectations. Instead of discarding this anomalous traffic as invalid, the Packet Forwarding Engine erroneously proceeds to instantiate a new session entry and allocates corresponding NAT resources from the global pool. This behavior indicates a fundamental lack of rigorous pre-validation checks before resource commitment, allowing an attacker to manipulate the device's memory management subsystem through crafted network packets.
From an operational perspective, this vulnerability enables a remote Denial-of-Service attack by any unauthenticated actor with network connectivity to the affected interface. By continuously transmitting these malformed IPv6 packets, an adversary can systematically exhaust available session tables and NAT pool entries. Since MX Series routers often serve as critical edge devices or core infrastructure components handling significant volumes of traffic, the exhaustion of these resources has severe consequences. The device becomes unable to establish new connections for legitimate users, effectively halting all network throughput passing through the compromised unit. This state persists until manual intervention occurs; specifically, a full system reboot is required to clear the exhausted sessions and reset NAT resource allocations, leading to significant downtime and potential service disruption for downstream networks dependent on this infrastructure.
The attack vector aligns with MITRE ATT&CK technique T1498: Network Denial of Service, where an attacker disrupts availability by consuming resources rather than exploiting confidentiality or integrity flaws. The specific mechanism involves resource exhaustion via malformed input, which is a common pattern in high-performance network devices that prioritize throughput over strict validation to maintain performance. However, the failure to drop invalid packets before allocation creates a predictable path for attackers to trigger this denial-of-service condition. Monitoring tools such as show services sessions summary and show services nat pool are essential for detecting early signs of resource depletion, allowing administrators to identify anomalous traffic patterns or session spikes that may indicate an ongoing exploitation attempt.
Mitigation strategies primarily involve applying the vendor-provided software patches to update Junos OS to a secure version. The vulnerability affects specific release tracks including all versions prior to 23.2R2-S4, 23.4 versions before 23.4R2-S5, and 24.2 versions before 24.2R2. Organizations running these affected versions must prioritize the upgrade process during maintenance windows to restore proper input validation behavior in the Packet Forwarding Engine. In environments where immediate patching is not feasible, implementing strict ingress filtering rules on upstream routers or firewalls can help block malformed IPv6 packets from reaching the vulnerable Juniper device. Additionally, configuring rate limiting for new session creation and monitoring NAT pool utilization metrics closely can provide early warning indicators of an active attack, allowing for rapid response before total resource exhaustion occurs.