CVE-2026-101950: Junos SRX heap overflow from malformed IPv4 packets

What it is

A heap-based buffer overflow (CWE-122) in the Secure Vector Routing (SVR) component of Junos OS on SRX Series firewalls. An attacker with network access sends malformed IPv4 packets to an interface configured for SVR. No login is needed. The packet-forwarding process crashes, which takes down traffic through the firewall. The record also rates confidentiality and integrity impact as high, so code execution can’t be ruled out, but the advisory’s headline impact is the crash.

Juniper found the bug itself. Its advisory says it is not aware of any malicious exploitation, and the CVE is not in the CISA KEV catalog as of catalog version 2026.10.16. CISA’s assessment in the CVE record rates exploitation as “none,” the bug as automatable, and technical impact as total. EPSS is low (0.5%, 39th percentile on 2026-10-16). No workaround exists, so patching is the only fix.

Juniper rebuilt some previously published 23.2, 23.4 and 24.2 releases (respins) to carry the fix, so check the full build number, not just the release train.

Am I affected?

You’re affected if you run Junos OS on an SRX Series firewall below the fixed builds in the table above and an interface is configured for Secure Vector Routing. The CVE record’s title says the crash happens “when Secure Vector Routing is enabled.”

If you don’t use SVR, the vulnerable path described in the record doesn’t apply. Still plan the upgrade, because the same releases carry other fixes.

The record doesn’t state whether other Junos platforms or Junos OS Evolved are affected by this CVE. Its title and description are limited to SRX Series.

What to do

1. Upgrade to the fixed release for your train: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3 (or 25.4R2), or 26.2R1-S2 (or 26.2R2, 26.4R1). Prioritise SRX units that use SVR and face untrusted networks.
2. There is no workaround. Juniper lists none. Until you patch, limit who can send traffic to SVR interfaces where your design allows it, and expect that forwarding could drop.
3. Plan for a crash, not a compromise. Confirm high-availability failover works on SRX clusters before and during the upgrade.
4. If you see unexplained forwarding-process crashes on an SVR device, open a case with Juniper support and keep the core files and logs before rebooting.

Detection

No indicators of compromise or exploitation signatures have been published. What you can watch for:

• Unexpected restarts or crashes of the packet-forwarding process on SRX devices with SVR, and core files created at the time.
• Unexplained failovers on SRX clusters.
• Malformed IPv4 packets arriving at SVR-configured interfaces, if you capture traffic upstream of the firewall.

Check Juniper’s advisory JSA112186 for any log messages it names; the advisory page could not be rendered when this analysis was written.