CVE-2024-39529: SRX Series: If DNS traceoptions are configured in a DGA or tunnel detection scenario specific DNS traffic leads to a PFE crash

Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.

Affected and fixed versions

Product / branch	Fixed in
Junos OS (SRX Series) 0	21.4R3-S6 or later
Junos OS (SRX Series) 22.2	22.2R3-S3 or later
Junos OS (SRX Series) 22.3	22.3R3-S3 or later
Junos OS (SRX Series) 22.4	22.4R3 or later
Junos OS (SRX Series) 23.2	23.2R2 or later

Always confirm against the vendor advisory, which lists every fixed hotfix.

What it is

A Use of Externally-Controlled Format String vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).

If DNS Domain Generation Algorithm (DGA) detection or tunnel detection, and DNS-filtering traceoptions are configured, and specific valid transit DNS traffic is received this causes a PFE crash and restart, leading to a Denial of Service.

This issue affects Junos OS: * All versions before 21.4R3-S6, * 22.2 versions before 22.2R3-S3, * 22.3 versions before 22.3R3-S3, * 22.4 versions before 22.4R3, * 23.2 versions before 23.2R2.

Am I affected?

To be exposed to this issue at least one of DGA or tunnel detection needs to be configured:

[ services security-metadata-streaming policy <name> dns detections dga ]

[ services security-metadata-streaming policy <name> dns detections tunneling ]

and DNS traceoptions have to be configured:

[ services dns-filtering traceoptions ... ]

Workarounds

There are no known workarounds for this issue.

Exploitation

Juniper SIRT is not aware of any malicious exploitation of this vulnerability.

KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.