CVE-2026-101938: Junos OS and Junos OS Evolved: SRX Series: An attacker causes a forwarding-plane outage when SVR vector routing is used
An Integer Underflow (Wrap or Wraparound) vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an adjacent unauthenticated attacker to cause a forwarding-plane denial of service via an ICMP message associated with an SVR carrier session.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Juniper Junos OS Evolved (SRX Series)to a version that resolves this vulnerability.Fixed in 23.2R2-S7.7-EVO - Upgrade
Upgrade
Juniper Junos OS Evolved (SRX Series)to a version that resolves this vulnerability.Fixed in 23.4R2-S8.11-EVO - Upgrade
Upgrade
Juniper Junos OS Evolved (SRX Series)to a version that resolves this vulnerability.Fixed in 24.2R2-S5.6-EVO - Upgrade
Upgrade
Juniper Junos OS Evolved (SRX Series)to a version that resolves this vulnerability.Fixed in 24.4R2-S5-EVO - Upgrade
Upgrade
Juniper Junos OS Evolved (SRX Series)to a version that resolves this vulnerability.Fixed in 25.2R2-S2-EVO - Upgrade
Upgrade
Juniper Junos OS Evolved (SRX Series)to a version that resolves this vulnerability.Fixed in 25.2X100-D35-EVO - Upgrade
Upgrade
Juniper Junos OS Evolved (SRX Series)to a version that resolves this vulnerability.Fixed in 25.4R1-S3-EVO - Upgrade
Upgrade
Juniper Junos OS Evolved (SRX Series)to a version that resolves this vulnerability.Fixed in 25.4R2-EVO - Upgrade
Upgrade
Juniper Junos OS Evolved (SRX Series)to a version that resolves this vulnerability.Fixed in 25.4X300-D40-EVO - Upgrade
Upgrade
Juniper Junos OS Evolved (SRX Series)to a version that resolves this vulnerability.Fixed in 26.2R1-S2-EVO - Upgrade
Upgrade
Juniper Junos OS Evolved (SRX Series)to a version that resolves this vulnerability.Fixed in 26.2R2-EVO - Upgrade
Upgrade
Juniper Junos OS Evolved (SRX Series)to a version that resolves this vulnerability.Fixed in 26.4R1-EVO - Upgrade
Upgrade
Juniper Junos OS (SRX Series)to a version that resolves this vulnerability.Fixed in 23.2R2-S7.7 - Upgrade
Upgrade
Juniper Junos OS (SRX Series)to a version that resolves this vulnerability.Fixed in 23.4R2-S8.13 - Upgrade
Upgrade
Juniper Junos OS (SRX Series)to a version that resolves this vulnerability.Fixed in 24.2R2-S5.5 - Upgrade
Upgrade
Juniper Junos OS (SRX Series)to a version that resolves this vulnerability.Fixed in 24.4R2-S5 - Upgrade
Upgrade
Juniper Junos OS (SRX Series)to a version that resolves this vulnerability.Fixed in 25.2R2-S2 - Upgrade
Upgrade
Juniper Junos OS (SRX Series)to a version that resolves this vulnerability.Fixed in 25.4R1-S3 - Upgrade
Upgrade
Juniper Junos OS (SRX Series)to a version that resolves this vulnerability.Fixed in 25.4R2 - Upgrade
Upgrade
Juniper Junos OS (SRX Series)to a version that resolves this vulnerability.Fixed in 26.2R1-S2 - Upgrade
Upgrade
Juniper Junos OS (SRX Series)to a version that resolves this vulnerability.Fixed in 26.2R2 - Upgrade
Upgrade
Juniper Junos OS (SRX Series)to a version that resolves this vulnerability.Fixed in 26.4R1
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated attacker adjacent to the affected SRX device can exploit it. The attack requires sending an ICMP message associated with an SVR carrier session.
What is the operational impact of successful exploitation?
Successful exploitation causes a denial of service in the forwarding plane. The provided information does not indicate confidentiality or integrity impact.
Which deployments are exposed?
The issue affects SRX Series devices running Junos OS or Junos OS Evolved when SVR vector routing is used. The provided information does not state whether SVR vector routing is enabled by default.