Junos OS (SRX firewalls)
CVE-2026-101938: SRX Series: An attacker causes a forwarding-plane outage when SVR vector routing is used
An Integer Underflow (Wrap or Wraparound) vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an adjacent unauthenticated attacker to cause a forwarding-plane denial of service via an ICMP message associated with an SVR carrier session.
Published Juniper Networks advisory JSA112186
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Junos OS (SRX Series) 0 | 23.2R2-S7.7 or later |
| Junos OS (SRX Series) 23.4 | 23.4R2-S8.13 or later |
| Junos OS (SRX Series) 24.2 | 24.2R2-S5.5 or later |
| Junos OS (SRX Series) 24.4 | 24.4R2-S5 or later |
| Junos OS (SRX Series) 25.2 | 25.2R2-S2 or later |
| Junos OS (SRX Series) 25.4 | 25.4R1-S3 or later |
| Junos OS (SRX Series) 26.2 | 26.2R1-S2 or later |
| Junos OS Evolved (SRX Series) 0 | 23.2R2-S7.7-EVO or later |
| Junos OS Evolved (SRX Series) 23.4 | 23.4R2-S8.11-EVO or later |
| Junos OS Evolved (SRX Series) 24.2 | 24.2R2-S5.6-EVO or later |
| Junos OS Evolved (SRX Series) 24.4 | 24.4R2-S5-EVO or later |
| Junos OS Evolved (SRX Series) 25.2 | 25.2R2-S2-EVO or later |
| Junos OS Evolved (SRX Series) 25.4 | 25.4R1-S3-EVO or later |
| Junos OS Evolved (SRX Series) 26.2 | 26.2R1-S2-EVO or later |
| Junos OS Evolved (SRX Series) 23.4X100 | See the advisory |
| Junos OS Evolved (SRX Series) 25.2X100 | 25.2X100-D35-EVO or later |
| Junos OS Evolved (SRX Series) 25.4X300 | 25.4X300-D40-EVO or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
In short
An integer underflow flaw in the srxpfe component of Junos OS on SRX Series firewalls allows an attacker to trigger a forwarding-plane denial of service. By sending a specific ICMP message associated with an SVR carrier session, an unauthenticated attacker on an adjacent network can disrupt traffic forwarding without requiring login credentials or user interaction.
Written by a language model from the vendor's description. Versions, fixes and exploitation status on this page come straight from the vendor and CISA.
The vendor's description
An Integer Underflow (Wrap or Wraparound) vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an adjacent unauthenticated attacker to cause a forwarding-plane denial of service via an ICMP message associated with an SVR carrier session.
Workarounds
There are no known workarounds for this issue.
Exploitation
Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 19 Oct 2026.