CVE-2026-102077: Junos OS: MX Series with SPC3: In a source NAT scenario malformed packets will lead to resource leaks and eventually traffic stops
An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series with SPC3 allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).
On MX Series with SPC3 line-card and source NAT configuration, when a specific malformed IPv6 packet is received, it is not dropped but instead a session is created and NAT resources are allocated. Continued receipt of such packets will eventually lead to session or resource exhaustion, which will impact all traffic through the device. To recover the device needs to be rebooted. To monitor session usage, use the following:
show services sessions summary
To monitor source NAT resource usage, use the following:
show services nat pool
This issue affects Junos OS on MX Series with SPC3:
All versions before 23.2R2-S4; 23.4 versions before 23.4R2-S5; 24.2 versions before 24.2R2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Juniper Junos OSto a version that resolves this vulnerability.Fixed in 23.2R2-S4 - Upgrade
Upgrade
Juniper Junos OSto a version that resolves this vulnerability.Fixed in 23.4R2-S5 - Upgrade
Upgrade
Juniper Junos OSto a version that resolves this vulnerability.Fixed in 24.2R2 - Upgrade
Upgrade
Juniper Junos OSto a version that resolves this vulnerability.Fixed in 24.4R1 - Operational
Reboot the device to recover from session or resource exhaustion caused by the malformed packets.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The issue affects Junos OS running on MX Series devices with an SPC3 line card when source NAT is configured. Devices outside that combination are not identified as affected in the provided information.
What does an attacker need to do to trigger the denial of service?
An unauthenticated network-based attacker must send specific malformed IPv6 packets to the device. Each such packet can create a session and allocate NAT resources instead of being dropped, allowing repeated traffic to exhaust sessions or resources.
How can I determine whether exploitation or resource exhaustion is occurring?
Monitor session usage with "show services sessions summary" and source NAT resource usage with "show services nat pool". Increasing or exhausted session and NAT resource usage may indicate the condition is being triggered.
What is the operational impact and recovery action if resources are exhausted?
Exhaustion impacts all traffic through the device. The provided information states that recovering the device requires a reboot.
Which Junos OS releases are affected?
Affected releases are all versions before 23.2R2-S4, 23.4 releases before 23.4R2-S5, and 24.2 releases before 24.2R2.