Junos OS (SRX firewalls)
CVE-2026-102078: SRX Series: A high volume of DNS traffic over TCP can lead to a flowd crash
A Use After Free vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).
Published Juniper Networks advisory JSA112181
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Junos OS (SRX Series) 0 | 23.2R2-S5 or later |
| Junos OS (SRX Series) 23.4 | 23.4R2-S6 or later |
| Junos OS (SRX Series) 24.2 | 24.2R2-S3 or later |
| Junos OS (SRX Series) 24.4 | 24.4R2-S1 or later |
| Junos OS (SRX Series) 25.2 | 25.2R1-S1, 25.2R2 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
In short
A use-after-free flaw in the packet forwarding engine of Junos OS on SRX firewalls allows an unauthenticated, network-based attacker to trigger a denial-of-service condition. By sending a high volume of DNS requests while web filtering for TCP traffic is enabled, the attacker can cause the flowd process to crash and restart, resulting in a complete service outage. This attack requires no prior access or user interaction, though the specific race condition is not directly controlled by the attacker.
Written by a language model from the vendor's description. Versions, fixes and exploitation status on this page come straight from the vendor and CISA.
The vendor's description
A Use After Free vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).
When web filtering for TCP traffic is configured, a high volume of DNS requests increases the likelihood of a flowd crash and restart, which leads to a complete service outage until the service has automatically recovered. This is a race condition outside the attacker's direct control.
This issue affects Junos OS on SRX Series:
- All versions before 23.2R2-S5;
- from 23.4 before 23.4R2-S6;
- from 24.2 before 24.2R2-S3;
- from 24.4 before 24.4R2-S1;
- from 25.2 before 25.2R1-S1, 25.2R2.
Workarounds
There are no known workarounds for this issue.
Exploitation
Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 19 Oct 2026.