CVE-2026-102078: Junos OS: SRX Series: A high volume of DNS traffic over TCP can lead to a flowd crash
A Use After Free vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).
When web filtering for TCP traffic is configured, a high volume of DNS requests increases the likelihood of a flowd crash and restart, which leads to a complete service outage until the service has automatically recovered. This is a race condition outside the attacker's direct control.
This issue affects Junos OS on SRX Series:
All versions before 23.2R2-S5; from 23.4 before 23.4R2-S6; from 24.2 before 24.2R2-S3; from 24.4 before 24.4R2-S1; from 25.2 before 25.2R1-S1, 25.2R2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Juniper Junos OS on SRX Seriesto a version that resolves this vulnerability.Fixed in 23.2R2-S5 - Upgrade
Upgrade
Juniper Junos OS on SRX Seriesto a version that resolves this vulnerability.Fixed in 23.4R2-S6 - Upgrade
Upgrade
Juniper Junos OS on SRX Seriesto a version that resolves this vulnerability.Fixed in 24.2R2-S3 - Upgrade
Upgrade
Juniper Junos OS on SRX Seriesto a version that resolves this vulnerability.Fixed in 24.4R2-S1 - Upgrade
Upgrade
Juniper Junos OS on SRX Seriesto a version that resolves this vulnerability.Fixed in 25.2R1-S1 - Upgrade
Upgrade
Juniper Junos OS on SRX Seriesto a version that resolves this vulnerability.Fixed in 25.2R2 - Upgrade
Upgrade
Juniper Junos OS on SRX Seriesto a version that resolves this vulnerability.Fixed in 25.4R1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
SRX Series devices running affected Junos OS releases are exposed when web filtering for TCP traffic is configured. The triggering traffic is a high volume of DNS requests over TCP.
What does an attacker need to do to exploit it?
An unauthenticated attacker needs network reachability to send a high volume of DNS traffic over TCP. Exploitation depends on a race condition, so a crash is not directly controllable or guaranteed for any individual request burst.
What is the operational impact if exploitation succeeds?
The flowd process can crash and restart, causing a complete service outage until it automatically recovers. The provided impact information indicates availability impact only, with no confidentiality or integrity impact.
Which Junos OS releases should be upgraded?
Upgrade to 23.2R2-S5 or later, 23.4R2-S6 or later, 24.2R2-S3 or later, 24.4R2-S1 or later, or 25.2R1-S1 or 25.2R2. All releases before 23.2R2-S5 are affected, as are the specified earlier releases in the later trains.