Juniper Junos OS: Denial of Service via malformed IPv6 packets in source NAT on MX SPC3
Summary
Junos OS on MX Series routers with an SPC3 line card can be affected when source NAT is configured. An unauthenticated remote attacker who sends specially malformed IPv6 packets can cause sessions and NAT resources to be allocated and not released. Continued traffic exhausts sessions or NAT resources, so the device stops forwarding traffic until it is rebooted.
Affected
- Junos OS on MX Series with SPC3, before 23.2R2-S4
- Junos OS on MX Series with SPC3, 23.4 before 23.4R2-S5
- Junos OS on MX Series with SPC3, 24.2 before 24.2R2
- Only with source NAT configured on the SPC3 line card
Fixed in
- Junos OS 23.2R2-S4
- Junos OS 23.4R2-S5
- Junos OS 24.2R2
- Junos OS 24.4R1 and later releases
- Exact build numbers: check the Juniper advisory JSA112182
Workaround
Unknown. No workaround is documented by Juniper.
Exploitation
- Juniper SIRT is not aware of any malicious exploitation.
- Not listed in CISA KEV.
- EPSS is low (0.00339).
- CISA SSVC: exploitation none, automatable yes.
Our recommendation
- Check whether your ISP, colocation or cloud provider uses MX Series routers with SPC3 for NAT, and ask them to confirm the fixed version is installed.
- If you operate such a device yourself, apply the fixed Junos OS release from JSA112182.
- Until patched, monitor session usage (show services sessions summary) and NAT pool usage (show services nat pool) for abnormal growth.
- Ask Juniper support whether a configuration or filter workaround exists for this IPv6 case.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Juniper Security Advisory JSA112182 supportportal.juniper.net
- VulnCheck/Vulnrichment record CVE-2026-102077 vulners.com
- OpenCVE CVE-2026-102077 app.opencve.io
- Vulners Nessus plugin JSA112182 vulners.com
- Canadian Centre for Cyber Security advisory AV25-491 www.cyber.gc.ca
- Threatint CVE record CVE-2026-102077 cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 02:51.
Original description (NVD)
An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series with SPC3 allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). On MX Series with SPC3 line-card and source NAT configuration, when a specific malformed IPv6 packet is received, it is not dropped but instead a session is created and NAT resources are allocated. Continued receipt of such packets will eventually lead to session or resource exhaustion, which will impact all traffic through the device. To recover the device needs to be rebooted. To monitor session usage, use the following: show services sessions summary To monitor source NAT resource usage, use the following: show services nat pool This issue affects Junos OS on MX Series with SPC3: * All versions before 23.2R2-S4; * 23.4 versions before 23.4R2-S5; * 24.2 versions before 24.2R2.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.