Juniper Junos OS: Stack-based buffer overflow in UTM Anti-Spam SBL on SRX
Summary
A stack-based buffer overflow in the UTM Anti-Spam SBL feature of Junos OS on SRX Series devices can be triggered by a malformed DNS packet. An unauthenticated remote attacker can exploit it when Anti-Spam SBL inspection is enabled, and the description cites arbitrary code execution or denial of service as possible outcomes. The official CNA title describes a service disruption, so code execution should be treated as the worst case until Juniper clarifies.
Affected
- Junos OS 0 to before 23.2R2-S7.7
- Junos OS 23.4 to before 23.4R2-S8.13
- Junos OS 24.2 to before 24.2R2-S5.5
- Junos OS 24.4 to before 24.4R2-S5
- Junos OS 25.2 to before 25.2R2-S2
- Junos OS 25.4 to before 25.4R1-S3
- Junos OS 26.2 to before 26.2R1-S2
- Default configuration is unaffected. The issue requires security utm default-configuration anti-spam type sbl.
Fixed in
- 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1 and all subsequent releases
- Respins were issued for 23.2, 23.4 and 24.2; previously published builds of these releases were rebuilt.
Workaround
- No known workarounds according to Juniper.
Exploitation
- Juniper SIRT is not aware of any malicious exploitation.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No public proof-of-concept was found in the research.
Our recommendation
- Inventory all SRX devices and record their exact Junos build.
- Check whether UTM Anti-Spam SBL is enabled on each device.
- If SBL is not needed, disable it until the upgrade is complete, after confirming the procedure with Juniper or your partner.
- Upgrade to a fixed build listed in JSA112186 and verify it on the Juniper advisory.
- Monitor the advisory and NVD for updates, since NVD analysis was still pending at publication.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Juniper Security Advisory JSA112186 supportportal.juniper.net
- OpenCVE: CVE-2026-101955 app.opencve.io
- Strix: CVE-2026-101955 www.strix.ai
- VulDB: Junos OS flaw vuldb.com
- Vulners: PT-2026-113808 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 04:32.
Original description (NVD)
A Stack-based Buffer Overflow vulnerability in the UTM Anti-Spam SBL of Juniper Networks Junos OS on SRX series allows an unauthenticated remote attacker to cause arbitrary code execution or a denial of service via a injected malformed DNS packet when Anti-Spam SBL inspection is enabled.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.