CVE-2026-102078 in Junos OS
Summary
by MITRE • 10/14/2026
A Use After Free vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).
When web filtering for TCP traffic is configured, a high volume of DNS requests increases the likelihood of a flowd crash and restart, which leads to a complete service outage until the service has automatically recovered. This is a race condition outside the attacker's direct control.
This issue affects Junos OS on SRX Series:
* All versions before 23.2R2-S5; * from 23.4 before 23.4R2-S6; * from 24.2 before 24.2R2-S3; * from 24.4 before 24.4R2-S1; * from 25.2 before 25.2R1-S1, 25.2R2.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/14/2026
The identified vulnerability represents a critical Use After Free flaw located within the packet forwarding engine of Juniper Networks Junos OS on SRX Series devices. This specific memory management error occurs when the system attempts to access memory that has already been deallocated, leading to undefined behavior and potential application crashes. In this context, the vulnerability is triggered under specific operational conditions where web filtering for TCP traffic is enabled. The root cause involves a race condition within the flow processing logic of the packet forwarding engine. When an attacker generates a high volume of DNS requests directed at protected hosts, the system experiences rapid creation and destruction of network flows. This intense churn in connection states creates a timing window where the software incorrectly references freed memory structures associated with these transient flows. Because this race condition is dependent on external traffic patterns and internal processing speeds, it exists outside the direct control of the attacker regarding precise execution timing, yet remains reliably exploitable through sustained high-volume DNS queries that stress the flow table management subsystems.
The operational impact of exploiting this vulnerability is severe, resulting in a Denial-of-Service condition for the affected SRX Series device. Specifically, the memory corruption causes the flowd process to crash and subsequently restart. Since flowd is responsible for maintaining state information for active network connections, its termination disrupts all traffic passing through the firewall that relies on connection tracking. This leads to a complete service outage as legitimate users are unable to establish or maintain TCP sessions while the service recovers. Although Junos OS includes mechanisms for automatic recovery of crashed processes, the downtime incurred during this restart period can be significant depending on system load and configuration complexity. During this window, network connectivity is effectively severed until the flowd daemon successfully reinitializes and resumes normal packet forwarding operations. This intermittent availability issue undermines the reliability of security controls that depend on continuous stateful inspection capabilities.
From a classification perspective, this vulnerability aligns with CWE-416, Use After Free, which describes situations where software continues to use a pointer after it has been freed. The exploitation technique leverages high-volume network traffic to induce resource exhaustion and timing-based failures, mapping closely to MITRE ATT&CK techniques related to Denial of Service via application layer flooding or protocol abuse. While the primary impact is availability rather than confidentiality or integrity loss, the ability to disrupt critical security infrastructure without authentication makes this a high-severity issue for organizations relying on SRX Series devices for perimeter defense and internal segmentation. The vulnerability affects multiple versions of Junos OS across various release branches, indicating that the underlying architectural flaw in how flow states are managed during rapid churn has persisted across several major software iterations until recent patches were applied.
Mitigation strategies primarily involve applying the vendor-recommended software updates to eliminate the flawed code paths within the packet forwarding engine. Administrators should upgrade their Junos OS installations to versions 23.2R2-S5 or later, 23.4R2-S6 or later, 24.2R2-S3 or later, 24.4R2-S1 or later, and 25.2R1-S1 or 25.2R2 for the respective affected branches. In environments where immediate patching is not feasible due to operational constraints, temporary mitigation measures should be implemented at upstream network devices such as routers or dedicated DDoS protection appliances. These controls can rate-limit DNS traffic directed toward SRX Series hosts that have web filtering enabled for TCP traffic. By reducing the volume of concurrent DNS requests and smoothing out flow creation rates, organizations can minimize the likelihood of triggering the race condition in the packet forwarding engine. Additionally, monitoring system logs for frequent flowd restarts can serve as an early warning indicator of potential exploitation attempts or accidental triggers due to legitimate but high-volume application behavior.