Junos OS (SRX firewalls)
CVE-2024-30398: SRX4600 Series - A high amount of specific traffic causes packet drops and an eventual PFE crash
An Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS).
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Junos OS (SRX4600) 21.2 | 21.2R3-S7 or later |
| Junos OS (SRX4600) 21.4 | 21.4R3-S6 or later |
| Junos OS (SRX4600) 22.1 | 22.1R3-S5 or later |
| Junos OS (SRX4600) 22.2 | 22.2R3-S3 or later |
| Junos OS (SRX4600) 22.3 | 22.3R3-S2 or later |
| Junos OS (SRX4600) 22.4 | 22.4R3 or later |
| Junos OS (SRX4600) 23.2 | 23.2R1-S2, 23.2R2 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
An Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS).
When a high amount of specific traffic is received on a SRX4600 device, due to an error in internal packet handling, a consistent rise in CPU memory utilization occurs. This results in packet drops in the traffic and eventually the PFE crashes. A manual reboot of the PFE will be required to restore the device to original state.
This issue affects Junos OS:
- 21.2 before 21.2R3-S7,
- 21.4 before 21.4R3-S6,
- 22.1 before 22.1R3-S5,
- 22.2 before 22.2R3-S3,
- 22.3 before 22.3R3-S2,
- 22.4 before 22.4R3,
- 23.2 before 23.2R1-S2, 23.2R2.
Workarounds
There are no known workarounds for this issue.
Exploitation
Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.