Juniper Junos OS up to 23.4R2-S6/24.2R2-S3/24.4R2-S2/25.2R1 TCP Proxy Plugin flowd quantity input validation

Summaryinfo

A vulnerability identified as critical has been detected in Juniper Junos OS up to 23.4R2-S6/24.2R2-S3/24.4R2-S2/25.2R1. This issue affects some unknown processing of the file flowd of the component TCP Proxy Plugin. Performing a manipulation of the argument quantity results in input validation. This vulnerability is reported as CVE-2026-57023. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability, which was classified as critical, was found in Juniper Junos OS up to 23.4R2-S6/24.2R2-S3/24.4R2-S2/25.2R1. This affects some unknown functionality of the file flowd of the component TCP Proxy Plugin. The manipulation of the argument quantity with an unknown input leads to a input validation vulnerability. CWE is classifying the issue as CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. This is going to have an impact on availability. The summary by CVE is:

An Improper Validation of Specified Quantity in Input vulnerability in the TCP proxy plugin of Juniper Networks Junos OS on MX Series with SPC3, and SRX Series allows an unauthenticated, network-based attacker to cause a complete Denial of Service (DoS). When TCP proxy is engaged in a flow session, to support ALGs, Advanced Anti-Malware, ICAP or UTM, a TCP packet with specifically malformed TCP header will cause flow processing daemon (flowd) to crash and restart. This causes a complete service outage until the system has automatically recovered. This issue affects Junos OS on MX with SPC3, and SRX Series:  * 23.4 versions before 23.4R2-S7,  * 24.2 versions before 24.2R2-S4,  * 24.4 versions before 24.4R2-S3, * 25.2 versions before 25.2R2. This issue does not affect releases before 23.4R1.

The advisory is shared at supportportal.juniper.net. This vulnerability is uniquely identified as CVE-2026-57023 since 06/23/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 07/10/2026).

Upgrading to version 23.4R2-S7, 24.2R2-S4, 24.4R2-S3 or 25.2R2 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• Juniper

Name

• Junos OS

Version

• 23.4R2-S6
• 24.2R2-S3
• 24.4R2-S2
• 25.2R1

License

• commercial

Website

• Vendor: https://www.juniper.net/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion