Junos OS (SRX firewalls)
CVE-2026-101973: Malformed packet causes pkid denial of service when certificate re-enrollment is used
A NULL Pointer Dereference vulnerability in the pkid component of Juniper Networks Junos OS allows an unauthenticated remote attacker to cause a denial of service via a malformed packet received during CMP enrollment or automatic certificate re-enrollment.
Published Juniper Networks advisory JSA112188
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Junos OS 0 | 23.2R2-S7.7 or later |
| Junos OS 23.4 | 23.4R2-S8.13 or later |
| Junos OS 24.2 | 24.2R2-S5.5 or later |
| Junos OS 24.4 | 24.4R2-S5 or later |
| Junos OS 25.2 | 25.2R2-S2 or later |
| Junos OS 25.4 | 25.4R1-S3 or later |
| Junos OS 26.2 | 26.2R1-S2 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
In short
A flaw in the pkid component of Junos OS on SRX firewalls allows an unauthenticated remote attacker to trigger a denial of service. By sending a malformed packet during CMP enrollment or automatic certificate re-enrollment, the attacker causes a NULL pointer dereference that disrupts service availability. This attack requires no prior access, login credentials, or user interaction.
Written by a language model from the vendor's description. Versions, fixes and exploitation status on this page come straight from the vendor and CISA.
The vendor's description
A NULL Pointer Dereference vulnerability in the pkid component of Juniper Networks Junos OS allows an unauthenticated remote attacker to cause a denial of service via a malformed packet received during CMP enrollment or automatic certificate re-enrollment.
Workarounds
There are no known workarounds for this issue.
Exploitation
Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 19 Oct 2026.