Juniper Junos OS up to 24.4R1 on SRX Web-Filtering improper validation of syntactic correctness of input

Summaryinfo

A vulnerability was found in Juniper Junos OS up to 23.2R2-S4/23.4R2-S4/24.2R2-S1/24.4R1-S3/24.4R1 on SRX. It has been rated as critical. This affects an unknown part of the component Web-Filtering Module. The manipulation leads to improper validation of syntactic correctness of input. This vulnerability is listed as CVE-2026-21917. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Juniper Junos OS up to 23.2R2-S4/23.4R2-S4/24.2R2-S1/24.4R1-S3/24.4R1 on SRX. This issue affects an unknown function of the component Web-Filtering Module. The manipulation with an unknown input leads to a improper validation of syntactic correctness of input vulnerability. Using CWE to declare the problem leads to CWE-1286. The product receives input that is expected to be well-formed - i.e., to comply with a certain syntax - but it does not validate or incorrectly validates that the input complies with the syntax. Impacted is availability. The summary by CVE is:

An Improper Validation of Syntactic Correctness of Input vulnerability in the Web-Filtering module of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). If an SRX device configured for UTM Web-Filtering receives a specifically malformed SSL packet, this will cause an FPC crash and restart. This issue affects Junos OS on SRX Series: * 23.2 versions from 23.2R2-S2 before 23.2R2-S5,  * 23.4 versions from 23.4R2-S1 before 23.4R2-S5, * 24.2 versions before 24.2R2-S2, * 24.4 versions before 24.4R1-S3, 24.4R2. Earlier versions of Junos are also affected, but no fix is available.

The advisory is shared at supportportal.juniper.net. The identification of this vulnerability is CVE-2026-21917 since 01/05/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 01/16/2026).

Upgrading to version 23.2R2-S5, 23.4R2-S5, 24.2R2-S2, 24.4R1-S3 or 24.4R2 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Router Operating System

Vendor

• Juniper

Name

• Junos OS

Version

• 23.2R2-S4
• 23.4R2-S4
• 24.2R2-S1
• 24.4R1
• 24.4R1-S3

License

• commercial

Website

• Vendor: https://www.juniper.net/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion