CVE-2026-102081 in Junos OS
Summary
by MITRE • 10/15/2026
A Missing Release of Memory after Effective Lifetime vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a complete Denial-of-Service (DoS).
On SRX4000 Series, and SRX5000 Series with SPC3, and MX Series with SPC3, when one or more specific application services like ALGs, IDP/DPI, APPID, SECINTEL, AAMW or AppQoE are configured, a high connections per second churn will cause PFE memory to leak. If the memory is exhausted traffic processing will be impacted.
Use the CLI command show security monitoring to monitor the memory utilization of the PFEs on the FPCs.
This issue affects Junos OS on SRX Series and MX Series:
* 23.4 versions from 23.4R2-S3 before 23.4R2-S7; * 24.2 versions from 24.2R2 before 24.2R2-S3; * 24.4 versions before 24.4R2-S3; * 25.2 versions before 25.2R1-S2, 25.2R2.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified as a missing release of memory after effective lifetime within the packet forwarding engine of Juniper Networks Junos OS represents a critical resource exhaustion flaw that can lead to severe service disruption on enterprise-grade network infrastructure. This issue specifically impacts SRX Series firewalls, including the high-performance SRX4000 and SRX5000 series equipped with SPC3 security processing cards, as well as MX Series routers utilizing similar hardware configurations. The root cause lies in the handling of specific application services when they are actively configured on the device. These services include Application Layer Gateways (ALGs), Intrusion Detection and Prevention systems combined with Deep Packet Inspection, AppID for traffic classification, Security Intelligence feeds, Advanced Access Management Web proxies, and Application Quality of Experience monitoring tools. When any combination of these features is enabled, the system becomes susceptible to a memory leak under specific load conditions rather than during normal static operation.
The operational trigger for this vulnerability involves high churn rates in network connections per second. In environments where there is rapid establishment and termination of sessions, such as those experiencing distributed denial-of-service attacks or legitimate but volatile traffic patterns from dynamic applications like VoIP or streaming services, the packet forwarding engine fails to properly deallocate memory associated with connection state tracking for these specific application protocols. Over time, this failure results in a progressive accumulation of unreleased memory blocks within the PFE process space. As the available memory pool diminishes due to this leak, the device's ability to process new packets degrades significantly. Eventually, when system resources are fully exhausted, traffic processing is impacted, leading to packet drops and ultimately causing a complete denial-of-service condition where legitimate users cannot access network services hosted behind or through the affected Juniper devices.
From a classification perspective, this vulnerability aligns with CWE-401, which describes missing release of memory after effective lifetime, indicating that allocated resources are not returned to the system when they are no longer needed. In terms of adversary behavior and tactical mapping within the MITRE ATT&CK framework, while this is primarily an unintentional software flaw rather than a direct exploit vector for code execution, it can be leveraged by attackers as part of Denial-of-Service campaigns (T1499). An attacker could intentionally generate high connection churn to trigger the memory leak and degrade network performance without needing authentication or complex exploitation techniques. This makes the vulnerability particularly dangerous in public-facing environments where unauthenticated traffic is common, allowing for a straightforward availability attack against critical infrastructure components that serve as gateways between internal networks and external internet segments.
Mitigation strategies focus on both software updates and operational monitoring to minimize risk until patches are applied. The primary remediation involves upgrading Junos OS to versions that contain the fix for this memory leak. Specifically, administrators should ensure their systems are running version 23.4R2-S7 or later for the 23.4 branch, 24.2R2-S3 or later for the 24.2 branch, 24.4R2-S3 or later for the 24.4 branch, and 25.2R1-S2 or 25.2R2 for the respective 25.2 releases. For organizations unable to immediately patch due to maintenance windows or stability concerns, proactive monitoring is essential. Administrators should utilize the CLI command show security monitoring to regularly check memory utilization metrics on the Packet Forwarding Engines located on the Flexible PIC Concentrator cards. By establishing baselines for normal memory usage and setting alerts for deviations indicative of a leak, network operations centers can detect early signs of resource exhaustion before it results in total service failure. Additionally, temporarily disabling non-essential application services such as IDP/DPI or ALGs during periods of known high connection churn may reduce the rate of memory leakage, although this reduces security posture and should be considered only as a temporary workaround while planning for permanent patching.