Junos OS (SRX firewalls)
CVE-2024-21609: MX Series with SPC3, and SRX Series: If specific IPsec parameters are negotiated iked will crash due to a memory leak
A Missing Release of Memory after Effective Lifetime vulnerability in the IKE daemon (iked) of Juniper Networks Junos OS on MX Series with SPC3, and SRX Series allows an administratively adjacent attacker which is able to successfully establish IPsec tunnels to cause a Denial of Service (DoS).
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Junos OS (MX Series with SPC3, SRX Series) 0 | 20.4R3-S9 or later |
| Junos OS (MX Series with SPC3, SRX Series) 21.2 | 21.2R3-S7 or later |
| Junos OS (MX Series with SPC3, SRX Series) 21.3 | 21.3R3-S5 or later |
| Junos OS (MX Series with SPC3, SRX Series) 21.4 | 21.4R3-S4 or later |
| Junos OS (MX Series with SPC3, SRX Series) 22.1 | 22.1R3-S3 or later |
| Junos OS (MX Series with SPC3, SRX Series) 22.2 | 22.2R3-S2 or later |
| Junos OS (MX Series with SPC3, SRX Series) 22.3 | 22.3R3 or later |
| Junos OS (MX Series with SPC3, SRX Series) 22.4 | 22.4R3 or later |
| Junos OS (MX Series with SPC3, SRX Series) 23.2 | 23.2R1-S2, 23.2R2 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
A Missing Release of Memory after Effective Lifetime vulnerability in the IKE daemon (iked) of Juniper Networks Junos OS on MX Series with SPC3, and SRX Series allows an administratively adjacent attacker which is able to successfully establish IPsec tunnels to cause a Denial of Service (DoS).
If specific values for the IPsec parameters local-ip, remote-ip, remote ike-id, and traffic selectors are sent from the peer, a memory leak occurs during every IPsec SA rekey which is carried out with a specific message sequence. This will eventually result in an iked process crash and restart.
The iked process memory consumption can be checked using the below command: user@host> show system processes extensive | grep iked PID USERNAME PRI NICE SIZE RES STATE C TIME WCPU COMMAND 56903 root 31 0 4016M 2543M CPU0 0 2:10 10.50% iked
This issue affects Juniper Networks Junos OS: * All versions earlier than 20.4R3-S9; * 21.2 versions earlier than 21.2R3-S7; * 21.3 versions earlier than 21.3R3-S5; * 21.4 versions earlier than 21.4R3-S4; * 22.1 versions earlier than 22.1R3-S3; * 22.2 versions earlier than 22.2R3-S2; * 22.3 versions earlier than 22.3R3; * 22.4 versions earlier than 22.4R3; * 23.2 versions earlier than 23.2R1-S2, 23.2R2.
Am I affected?
To be exposed to this issue IPsec VPN needs to be configured with a minimal ike configuration:
[ security ike gateway ike-policy ]
[ security ipsec vpn ike gateway ]
and the system needs to run iked (vs. kmd which is not affected), which can be verified with:
show system processes extensive | match "KMD|IKED"
Workarounds
While there is no workaround available, customers can monitor the memory utilization and restart iked periodically to clear the leak.
Exploitation
Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.