Junos OS (SRX firewalls)
CVE-2026-102176: Specific packets cause SDK service crash or Routing Engine compromise when the SDK service and JDAF is enabled
A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in the SDK service process of Juniper Networks Junos OS allows an unauthenticated network attacker to cause a denial of service or compromise the Routing Engine by sending specific packets when the SDK service and a JDAF routing instance are enabled.
Published Juniper Networks advisory JSA112188
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Junos OS 0 | 23.2R2-S7.7 or later |
| Junos OS 23.4 | 23.4R2-S8.13 or later |
| Junos OS 24.2 | 24.2R2-S5.5 or later |
| Junos OS 24.4 | 24.4R2-S5 or later |
| Junos OS 25.2 | 25.2R2-S2 or later |
| Junos OS 25.4 | 25.4R1-S3 or later |
| Junos OS 26.2 | 26.2R1-S2 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
In short
A buffer overflow flaw in the SDK service process of Junos OS on SRX firewalls allows an unauthenticated attacker to send specific packets from an adjacent network. This action can cause a denial of service or compromise the Routing Engine, provided the SDK service and a JDAF routing instance are enabled.
Written by a language model from the vendor's description. Versions, fixes and exploitation status on this page come straight from the vendor and CISA.
The vendor's description
A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in the SDK service process of Juniper Networks Junos OS allows an unauthenticated network attacker to cause a denial of service or compromise the Routing Engine by sending specific packets when the SDK service and a JDAF routing instance are enabled.
Am I affected?
[ system processes sdk-service enable ] [ services jdaf routing-instances default ]
Workarounds
Disable sdk-service if it is not required.
Exploitation
Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 19 Oct 2026.