Juniper Junos OS Heap Overflow Lets Attackers Crash SRX Firewalls
A critical unauthenticated buffer overflow in Juniper SRX series devices allows remote attackers to cause denial of service or compromise data integrity via malformed packets.
Key points
- CVE-2026-101950 is rated Critical with a CVSS score of 9.8 by the NVD.
- The flaw exists in the SVR component of Junos OS on SRX Series devices.
- Attackers can exploit the issue using malformed IPv4 packets without authentication.
The National Vulnerability Database recorded CVE-2026-101950 as a critical vulnerability affecting Juniper Networks Junos OS. This heap-based buffer overflow allows unauthenticated network attackers to crash SRX Series devices or potentially steal data.
At a glance
- CVE
- CVE-2026-101950
- Product
- Juniper Networks Junos OS
- CVSS
- 9.8 Critical
- Weakness
- heap-based buffer overflow
- Exploited
- No known exploitation
The flaw resides in the Secure Vector Routing component of the operating system. According to the NVD record, sending malformed IPv4 packets to an interface configured for this routing feature triggers the overflow. This can result in denial of service or compromise of confidentiality and integrity.
Technical Details and Severity
The National Vulnerability Database assigned a CVSS score of 9.8 to this issue, classifying it as Critical. The weakness is categorized under CWE-122, which covers heap-based buffer overflow vulnerabilities. Because the attack requires no authentication, any network attacker with reach to the affected interface can attempt exploitation.
The vulnerability specifically targets the SVR component within Junos OS. When an interface is configured for Secure Vector Routing, the system processes incoming IPv4 packets in a way that exposes this buffer overflow risk. Attackers can craft specific malformed packets to trigger the crash or gain unauthorized access to system resources.
Affected Versions and Scope
Juniper Networks Junos OS versions prior to specific maintenance releases are vulnerable to this attack. The NVD record lists several affected version branches that require updates to mitigate the risk. Organizations using these older versions on SRX Series hardware are exposed to the threat.
The following version ranges are identified as affected in the NVD record:
- Junos OS versions before 23.2R2-S7.7
- Junos OS versions before 23.4R2-S8.13
- Junos OS versions before 24.2R2-S5.5
- Junos OS versions before 24.4R2-S5
Any SRX Series device running a version older than these thresholds is susceptible to the heap-based buffer overflow. Administrators must verify their current software versions against this list to determine if their infrastructure is at risk.
What should you do?
Organizations should immediately audit their SRX Series devices to identify any systems running vulnerable versions of Junos OS. Since the flaw allows unauthenticated remote exploitation, exposure to the internet or untrusted networks significantly increases the risk of a successful attack.
What to do and how to stay safe: Juniper Networks
- Inventory all SRX Series devices and compare current Junos OS versions against the unaffected thresholds listed in the NVD record.
- Restrict access to interfaces configured for Secure Vector Routing by implementing strict firewall rules that block unsolicited IPv4 traffic from untrusted sources.
- Monitor network logs for unusual spikes in malformed IPv4 packets or unexpected device reboots that may indicate exploitation attempts.
- Plan to upgrade affected systems to the latest supported maintenance releases once the vendor provides an update.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-101950?
The NVD rates CVE-2026-101950 as Critical with a CVSS score of 9.8.
Which Juniper devices are affected by this vulnerability?
Juniper Networks SRX Series devices running Junos OS versions prior to the specified maintenance releases are affected.
Can an attacker exploit this flaw without logging in?
Yes, the NVD record states that an unauthenticated network attacker can exploit this vulnerability via malformed IPv4 packets.
