Junos OS (SRX firewalls)
CVE-2026-102081: SRX4000 Series, SRX5000 Series and MX Series with SPC3: With application services configured, high session churn causes memory leak which will ultimately impact traffic
A Missing Release of Memory after Effective Lifetime vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a complete Denial-of-Service (DoS).
Published Juniper Networks advisory JSA112177
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Junos OS (SRX 4000 Series, SRX 5000 Series with SPC3, MX Series with SPC3) 23.4R2-S3 | 23.4R2-S7 or later |
| Junos OS (SRX 4000 Series, SRX 5000 Series with SPC3, MX Series with SPC3) 24.2R2 | 24.2R2-S3 or later |
| Junos OS (SRX 4000 Series, SRX 5000 Series with SPC3, MX Series with SPC3) 24.4 | 24.4R2-S3 or later |
| Junos OS (SRX 4000 Series, SRX 5000 Series with SPC3, MX Series with SPC3) 25.2 | 25.2R1-S2, 25.2R2 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
In short
The packet forwarding engine in Junos OS on SRX Series firewalls fails to properly release memory after its effective lifetime. An unauthenticated attacker can exploit this by generating a high rate of connection churn when specific application services are configured, causing the device to leak memory. As memory is exhausted, the firewall's ability to process traffic is impaired, resulting in a complete denial of service.
Written by a language model from the vendor's description. Versions, fixes and exploitation status on this page come straight from the vendor and CISA.
The vendor's description
A Missing Release of Memory after Effective Lifetime vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a complete Denial-of-Service (DoS).
On SRX4000 Series, and SRX5000 Series with SPC3, and MX Series with SPC3, when one or more specific application services like ALGs, IDP/DPI, APPID, SECINTEL, AAMW or AppQoE are configured, a high connections per second churn will cause PFE memory to leak. If the memory is exhausted traffic processing will be impacted.
Use the CLI command show security monitoring to monitor the memory utilization of the PFEs on the FPCs.
This issue affects Junos OS on SRX Series and MX Series:
- 23.4 versions from 23.4R2-S3 before 23.4R2-S7;
- 24.2 versions from 24.2R2 before 24.2R2-S3;
- 24.4 versions before 24.4R2-S3;
- 25.2 versions before 25.2R1-S2, 25.2R2.
Workarounds
There are no known workarounds for this issue.
Exploitation
Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 19 Oct 2026.