CVE-2026-101955: Junos OS: SRX Series: Malformed DNS packet causes service disruption when UTM Anti-Spam SBL is used
A Stack-based Buffer Overflow vulnerability in the UTM Anti-Spam SBL of Juniper Networks Junos OS on SRX series allows an unauthenticated remote attacker to cause arbitrary code execution or a denial of service via a injected malformed DNS packet when Anti-Spam SBL inspection is enabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Juniper Junos OSto a version that resolves this vulnerability.Fixed in 23.2R2-S7.7 - Upgrade
Upgrade
Juniper Junos OSto a version that resolves this vulnerability.Fixed in 23.4R2-S8.13 - Upgrade
Upgrade
Juniper Junos OSto a version that resolves this vulnerability.Fixed in 24.2R2-S5.5 - Upgrade
Upgrade
Juniper Junos OSto a version that resolves this vulnerability.Fixed in 24.4R2-S5 - Upgrade
Upgrade
Juniper Junos OSto a version that resolves this vulnerability.Fixed in 25.2R2-S2 - Upgrade
Upgrade
Juniper Junos OSto a version that resolves this vulnerability.Fixed in 25.4R1-S3 - Upgrade
Upgrade
Juniper Junos OSto a version that resolves this vulnerability.Fixed in 25.4R2 - Upgrade
Upgrade
Juniper Junos OSto a version that resolves this vulnerability.Fixed in 26.2R1-S2 - Upgrade
Upgrade
Juniper Junos OSto a version that resolves this vulnerability.Fixed in 26.2R2 - Upgrade
Upgrade
Juniper Junos OSto a version that resolves this vulnerability.Fixed in 26.4R1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Juniper Networks Junos OS deployments on SRX Series devices are exposed when UTM Anti-Spam SBL inspection is enabled. The provided information does not identify affected releases or whether this feature is enabled by default.
What does an attacker need to exploit it?
An unauthenticated remote attacker needs to send an injected malformed DNS packet to a vulnerable SRX device with Anti-Spam SBL inspection enabled. No credentials or user interaction are required, although the listed attack complexity is high.
What is the potential impact of successful exploitation?
Successful exploitation can cause denial of service or arbitrary code execution. The vulnerability is rated high severity with impacts to confidentiality, integrity, and availability.
What can be done if patching cannot happen immediately?
The available information identifies Anti-Spam SBL inspection as the affected condition. Disabling that inspection feature, where operationally acceptable, would remove the stated exposure condition; the provided data does not specify other mitigations.