Junos OS (SRX firewalls)
CVE-2026-102086: SRX Series: Multiple DNS queries processed by SecIntel and DGA in the same session cause a flowd crash
A NULL Pointer Dereference vulnerability in the DNS plugin of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a complete Denial-of-Service (DoS).
Published Juniper Networks advisory JSA112170
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Junos OS (SRX Series) 0 | 23.2R2-S7.7 or later |
| Junos OS (SRX Series) 23.4 | 23.4R2-S8.13 or later |
| Junos OS (SRX Series) 24.2 | 24.2R2-S5.5 or later |
| Junos OS (SRX Series) 24.4 | 24.4R2-S4 or later |
| Junos OS (SRX Series) 25.2 | 25.2R2-S1 or later |
| Junos OS (SRX Series) 25.4 | 25.4R1-S2 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
In short
A NULL pointer dereference in the DNS plugin of Junos OS on SRX Series firewalls allows an unauthenticated, network-based attacker to cause a complete Denial-of- Service. The flaw occurs when multiple DNS queries in a single flow session trigger specific asynchronous logging tasks, leading to a crash of the Flexible PIC Concentrator. The attacker requires no login or user interaction, though the exact timing conditions for the crash are outside their direct control.
Written by a language model from the vendor's description. Versions, fixes and exploitation status on this page come straight from the vendor and CISA.
The vendor's description
A NULL Pointer Dereference vulnerability in the DNS plugin of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a complete Denial-of-Service (DoS).
When multiple DNS queries are received in a single flow session, where one query matches a Security Intelligence (SecIntel) feed and another query is sent for DNS Domain Generation Algorithm (DGA) analysis, an error in processing logging of these asynchronous tasks can lead to an FPC crash. The exact timing conditions are outside an attacker's direct control.
This issue affects Junos OS on SRX Series:
- All versions before 23.2R2-S7.7;
- from 23.4 before 23.4R2-S8.13;
- from 24.2 before 24.2R2-S5.5;
- from 24.4 before 24.4R2-S4;
- from 25.2 before 25.2R2-S1;
- from 25.4 before 25.4R1-S2.
Am I affected?
[ services security-metadata-streaming policy <name> dns detections <type> (fallback-options) notification log ]
[ services security-intelligence profile <name> rule <name> then log ]
Workarounds
There are no known workarounds for this issue, but if not strictly required the logging should be turned off.
Exploitation
Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 19 Oct 2026.