Juniper Junos OS up to 24.2R0/24.2R2-S2/24.4R2-S0/25.2R1-S1 Packet Forwarding Engine flowd setting timeout race condition

Summaryinfo

A vulnerability was found in Juniper Junos OS up to 24.2R0/24.2R2-S2/24.4R2-S0/25.2R1-S1. It has been rated as critical. Impacted is the function Setting of the file flowd of the component Packet Forwarding Engine. Performing a manipulation of the argument timeout results in race condition. This vulnerability is cataloged as CVE-2026-57030. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in Juniper Junos OS up to 24.2R0/24.2R2-S2/24.4R2-S0/25.2R1-S1. It has been classified as critical. This affects the function setting of the file flowd of the component Packet Forwarding Engine. The manipulation of the argument timeout with an unknown input leads to a race condition vulnerability. CWE is classifying the issue as CWE-362. The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently. This is going to have an impact on availability. The summary by CVE is:

A Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). As part of the stateful traffic processing on SRX Series devices flows are being established, and removed when not needed anymore. During the removal process the timeout of a flow should be set to 3 seconds and consequentially the flow should be removed shortly after. Due to a race condition occurring when setting the timeout there is a chance (the exact conditions are outside the attackers control) that the timeout is instead set to a very high value of larger than 10,000 seconds: user@host> show security flow session | match timeout Session ID: 98784248524, Policy name: PROD-FLOW/4, HA State: Active, Timeout: 85250, Session State: Valid This will lead to an accumulation of flows which can be observed by an ever-increasing value of invalidated sessions in the output of 'show security flow session summary': user@host> show security flow session summary | match invalid Invalidated sessions: 216931These sessions can't be cleared manually with the 'clear security flow session' command, which will either lead to forwarding to stop (and the system needs to be manually recovered with a reboot) or to a flowd core and automatic reboot. This issue affects Junos OS on SRX Series: * 24.2 versions before 24.2R2-S3, * 24.4 versions before 24.4R2-S1, 24.4R2-S2, * 25.2 versions before 25.2R1-S2, 25.2R2. This issue does not affect releases earlier than 24.2R1;

The advisory is shared at supportportal.juniper.net. This vulnerability is uniquely identified as CVE-2026-57030 since 06/23/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 07/10/2026).

Upgrading to version 24.2R1, 24.2R2-S3, 24.4R2-S1 or 25.2R1-S2 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Router Operating System

Vendor

• Juniper

Name

• Junos OS

Version

• 24.2R0
• 24.2R2-S2
• 24.4R2-S0
• 25.2R1-S1

License

• commercial

Website

• Vendor: https://www.juniper.net/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion