CVE-2026-57030: Junos OS: SRX Series: Flow sessions are not getting cleared leading to a DoS
A Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).
As part of the stateful traffic processing on SRX Series devices flows are being established, and removed when not needed anymore. During the removal process the timeout of a flow should be set to 3 seconds and consequentially the flow should be removed shortly after. Due to a race condition occurring when setting the timeout there is a chance (the exact conditions are outside the attackers control) that the timeout is instead set to a very high value of larger than 10,000 seconds:
user@host> show security flow session | match timeout Session ID: 98784248524, Policy name: PROD-FLOW/4, HA State: Active, Timeout: 85250, Session State: Valid
This will lead to an accumulation of flows which can be observed by an ever-increasing value of invalidated sessions in the output of 'show security flow session summary':
user@host> show security flow session summary | match invalid Invalidated sessions: 216931These sessions can't be cleared manually with the 'clear security flow session' command, which will either lead to forwarding to stop (and the system needs to be manually recovered with a reboot) or to a flowd core and automatic reboot.
This issue affects Junos OS on SRX Series:
24.2 versions before 24.2R2-S3, 24.4 versions before 24.4R2-S1, 24.4R2-S2, 25.2 versions before 25.2R1-S2, 25.2R2.
This issue does not affect releases earlier than 24.2R1;
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Juniper Networks Junos OS (SRX Series)to a version that resolves this vulnerability.Fixed in 24.2R2-S3 - Upgrade
Upgrade
Juniper Networks Junos OS (SRX Series)to a version that resolves this vulnerability.Fixed in 24.4R2-S1 - Upgrade
Upgrade
Juniper Networks Junos OS (SRX Series)to a version that resolves this vulnerability.Fixed in 25.2R1-S2 - Upgrade
Upgrade
Juniper Networks Junos OS (SRX Series)to a version that resolves this vulnerability.Fixed in 25.2R2 - Upgrade
Upgrade
Juniper Networks Junos OS (SRX Series)to a version that resolves this vulnerability.Fixed in 25.4R1 - Configuration
Ensure that during the removal process the flow timeout is set to 3 seconds so the flow is removed shortly after (mitigates the race condition where the timeout may be set to >10000 seconds).
Juniper Networks Junos OS (SRX Series) packet forwarding engine (PFE) Flow timeout on session removal = 3 seconds - Compensating control
Do not rely on the 'clear security flow session' command to clear invalidated sessions for this issue; it can lead to forwarding stopping or a flowd core and automatic reboot. Instead, prepare for manual recovery (including reboot if needed) after applying the resolved software updates and/or after confirming invalidated sessions and timeouts.
- Operational
Manually recover the SRX device with a reboot if forwarding stops after attempting to clear invalidated sessions (the material states manual recovery with a reboot may be required).
- Operational
Verify mitigation by checking invalidated sessions and flow timeouts using: 'show security flow session summary | match invalid' and 'show security flow session | match timeout' (watch for the ever-increasing 'invalidated sessions' counter described).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-57030?
The severity of CVE-2026-57030 is rated medium with a score of 5.9.
How do I fix CVE-2026-57030?
To fix CVE-2026-57030, update the Junos OS on SRX Series devices to the latest version that addresses the vulnerability.
What type of attack does CVE-2026-57030 facilitate?
CVE-2026-57030 allows an unauthenticated attacker to cause a Denial-of-Service (DoS) on affected devices.
Which devices are affected by CVE-2026-57030?
CVE-2026-57030 affects devices running Juniper Networks Junos OS on the SRX Series.
What component of Junos OS is vulnerable in CVE-2026-57030?
The vulnerability in CVE-2026-57030 is within the packet forwarding engine (PFE) of Junos OS.