Juniper Junos OS SRX: Denial of service via flowd crash on high DNS-over-TCP load
Summary
A Use-after-Free flaw in the packet forwarding engine of Junos OS on SRX Series firewalls can be triggered remotely without authentication. When web filtering for TCP traffic is configured, a high volume of DNS requests over TCP can crash and restart the flowd process, causing a complete service outage until the service recovers automatically. The attacker does not control the underlying race condition. No exploitation has been reported by Juniper.
Affected
- Junos OS on SRX Series before 23.2R2-S5
- 23.4 before 23.4R2-S6
- 24.2 before 24.2R2-S3
- 24.4 before 24.4R2-S1
- 25.2 before 25.2R1-S1 and 25.2R2 (per CVE record; confirm in JSA112181)
Fixed in
- 23.2R2-S5
- 23.4R2-S6
- 24.2R2-S3
- 24.4R2-S1
- 25.2R1-S1 and 25.2R2 (confirm in JSA112181)
- 25.4R1 and all subsequent releases
Workaround
Unknown. The CNA record states there are no known workarounds. Check JSA112181 before changing configuration.
Exploitation
- Juniper SIRT is not aware of malicious exploitation.
- CISA SSVC: exploitation none, automatable no, technical impact partial.
- No public proof of concept found in the research notes.
Our recommendation
- Identify SRX devices with web filtering enabled and compare their Junos versions with the fixed releases.
- Plan the upgrade according to JSA112181, covering related Junos OS and Junos OS Evolved advisories in the same batch.
- Monitor DNS-over-TCP volume on affected devices until patching is complete.
- Verify the advisory directly, as the affected and fixed versions could not be checked against the vendor page.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Juniper Security Advisory JSA112181 supportportal.juniper.net
- OpenCVE CVE-2026-102078 app.opencve.io
- Vulners VulnRichment CVE-2026-102078 vulners.com
- Strix CVE-2026-102078 www.strix.ai
- GovCERT.HK alert www.govcert.gov.hk
- VulDB entry 420085 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 16:23.
Original description (NVD)
A Use After Free vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). When web filtering for TCP traffic is configured, a high volume of DNS requests increases the likelihood of a flowd crash and restart, which leads to a complete service outage until the service has automatically recovered. This is a race condition outside the attacker's direct control. This issue affects Junos OS on SRX Series: * All versions before 23.2R2-S5; * from 23.4 before 23.4R2-S6; * from 24.2 before 24.2R2-S3; * from 24.4 before 24.4R2-S1; * from 25.2 before 25.2R1-S1, 25.2R2.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.