Junos OS: Stack-based buffer overflow in httpd (J-Web virtual domain)

Summary

A stack-based buffer overflow in the httpd process of Junos OS and Junos OS Evolved affects devices with a J-Web virtual domain configured, specifically with mutual TLS (mtls) enabled. An unauthenticated remote attacker can send crafted requests to trigger remote code execution or a denial of service. The CVSS v4.0 base score is 9.3 (Critical). Juniper SIRT is not aware of any malicious exploitation.

Affected

• Junos OS: versions before 23.4R2-S8.13, before 24.2R2-S5.5, before 24.4R2-S5, before 25.2R2-S2, before 25.4R1-S3 and before 26.2R1-S2 (per CNA record; default configuration unaffected)
• Junos OS Evolved: versions before 23.4R2-S8.11-EVO, before 24.2R2-S5.6-EVO, before 24.4R2-S5-EVO, before 25.2R2-S2-EVO, before 25.4R1-S3-EVO and before 26.2R1-S2-EVO
• Special builds 23.4X100, 25.2X100 and 25.4X300 (Evolved): Unknown until checked against the advisory
• Only configurations with system services web-management https virtual-domain <name> mtls are affected

Fixed in

• Junos OS: 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1 and all subsequent releases
• Junos OS Evolved: 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO and all subsequent releases
• Previously published 23.4 and 24.2 releases were respun; install the referenced respins

Workaround

• Unknown. The vendor workaround text could not be retrieved.
• Unverified: disabling J-Web where it is not needed removes this attack path.

Exploitation

• Juniper SIRT is not aware of any malicious exploitation.
• Not listed in CISA KEV (catalog version 2026.10.23).
• CISA SSVC: exploitation none, automatable yes, technical impact total.

Our recommendation

• Inventory all Junos OS and Junos OS Evolved devices and check whether web-management https virtual-domain with mtls is configured.
• Upgrade affected devices to the fixed build for your release branch as soon as possible, using the respins for 23.4 and 24.2.
• Until patched, restrict access to the J-Web management interface to trusted management networks and remove unneeded virtual-domain configuration.
• Verify the exact build for special Evolved releases against JSA112187 before relying on version numbers.
• Monitor management interface logs for unusual requests and crashes of httpd.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Juniper Security Advisory JSA112187 supportportal.juniper.net
• VulnCheck/Vulners CVE record vulners.com
• DEV analysis (facilishz) dev.to
• threatint CVE record cve.threatint.com
• OpenCVE CVE record app.opencve.io
• DEV: Auditing exposed Junos devices (October 2026) dev.to

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:48.