CVE-2026-102083 in Junos OS
Summary
by MITRE • 10/15/2026
An Improper Resource Locking vulnerability in the UTM processing of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).
When UTM WebFiltering is configured and the WebFiltering cloud server is unreachable, sustained HTTP traffic load may cause the UTM subsystem to crash and restart, which will lead to a complete service outage until the system has recovered. When category lookup requests cannot be completed, they accumulate internally. Under high load and specific timing conditions, an invalid internal state can occur during cleanup of pending WebFiltering lookups, resulting in a crash of the UTM process. This issue applies to both NextGeneration WebFiltering (NGWF) and Enhanced WebFiltering (EWF).
This issue affects Junos OS on SRX Series:
* 23.2 versions from 23.2R2 before 23.2R2-S7.7; * 23.4 versions from 23.4R2 before 23.4R2-S8.13; * 24.2 versions before 24.2R2-S5.5; * 24.4 versions before 24.4R2-S4; * 25.2 versions before 25.2R2-S1; * 25.4 versions before 25.4R1-S3, 25.4R2.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability described constitutes a critical flaw within the Unified Threat Management (UTM) subsystem of Juniper Networks Junos OS operating on SRX Series devices, specifically impacting both NextGeneration WebFiltering and Enhanced WebFiltering functionalities. This issue is classified as an Improper Resource Locking error that manifests under specific network conditions where the configured WebFiltering cloud server becomes unreachable. The core technical flaw arises from how the system handles pending category lookup requests when external connectivity to the filtering service is lost. Under normal operation, these lookups are processed and cleared efficiently; however, when the remote server is inaccessible, request accumulation occurs within the internal buffers of the UTM process.
The operational impact becomes severe under sustained HTTP traffic loads combined with specific timing conditions related to resource cleanup. As pending WebFiltering requests accumulate due to the unreachable cloud service, they consume system resources and create a backlog that must be managed by the operating system's memory management and locking mechanisms. The vulnerability is triggered during the cleanup phase of these pending lookups, where an invalid internal state emerges within the UTM process. This race condition or improper handling of locks leads directly to a crash and subsequent restart of the critical UTM subsystem. Consequently, this results in a complete service outage for all traffic passing through the SRX device until the system recovers from the fault, effectively causing a Denial-of-Service against any users relying on that network segment for internet access or filtered web content.
From a threat modeling perspective, this vulnerability aligns with CWE-832 (Unlock of an Acquired Lock) and CWE-617 (Reachable Assertion), as it involves improper synchronization leading to system instability. In the context of MITRE ATT&CK, this behavior is consistent with T1499 Endpoint Denial of Service or potentially T1505 Server Software Component if viewed through the lens of exploiting a specific software component for disruption. The attack vector requires no authentication and can be executed remotely by an attacker who controls network traffic patterns to sustain high HTTP loads while simultaneously ensuring that the Juniper device cannot reach its designated WebFiltering cloud provider, such as by blocking outbound DNS or HTTPS traffic to those specific endpoints during the test window.
Mitigation strategies must address both the software version vulnerabilities and the operational configuration risks. Administrators should immediately upgrade their Junos OS installations to patched versions across all affected branches: 23.2R2-S7.7 or later for the 23.2 branch, 23.4R2-S8.13 or later for 23.4, 24.2R2-S5.5 or later for 24.2, 24.4R2-S4 or later for 24.4, 25.2R2-S1 or later for 25.2, and 25.4R1-S3 or 25.4R2 for the 25.4 branch. In environments where immediate patching is not feasible due to maintenance windows, temporary mitigations include configuring local web filtering policies as a fallback mechanism so that category lookups do not rely solely on external cloud servers during outages. Additionally, implementing rate limiting on HTTP traffic can help reduce the likelihood of triggering the high-load conditions necessary for this race condition to manifest, although this is only a partial defense and does not resolve the underlying code defect.