IT SBIT Services
Schneeberger
DEEN
CVE tracker

Juniper Junos OS: Memory leak in PFE leads to denial of service on SRX and MX

CVE-2026-102081High 8.7

← All vulnerabilities

Summary

Juniper Junos OS on SRX4000 and SRX5000 Series with SPC3, and MX Series with SPC3, leaks memory in the packet forwarding engine when certain application services (ALG, IDP/DPI, AppID, SecIntel, AAMW or AppQoE) are configured and connections per second churn is high. An unauthenticated remote attacker can exhaust PFE memory, which impacts traffic processing and can lead to a complete denial of service. The vendor rates the issue as CVSS 4.0 8.7 (High).

Affected

  • Junos OS 23.4: from 23.4R2-S3 before 23.4R2-S7
  • Junos OS 24.2: from 24.2R2 before 24.2R2-S3
  • Junos OS 24.4: before 24.4R2-S3
  • Junos OS 25.2: before 25.2R1-S2 and 25.2R2
  • Applies to SRX4000 Series, SRX5000 Series with SPC3, and MX Series with SPC3 when the listed application services are configured
  • Earlier releases: verify against JSA112177

Fixed in

  • 23.4R2-S7
  • 24.2R2-S3
  • 24.4R2-S3
  • 25.2R1-S2 or 25.2R2
  • 25.4R1 and all subsequent releases

Workaround

  • No known workarounds. Juniper's advisory names no mitigation that removes the leak.

Exploitation

  • Juniper SIRT is not aware of malicious exploitation.
  • CISA SSVC: exploitation none, automatable yes, technical impact partial.
  • No public proof of concept found. EPSS score 0.00374 (low).
  • Third-party aggregator reports the CVE is not in CISA KEV; confirm on CISA's catalogue.

Our recommendation

  • Check whether your devices are SRX4000, SRX5000 with SPC3, or MX with SPC3 and whether the listed application services are enabled.
  • Monitor PFE memory utilisation with the CLI command show security monitoring.
  • Plan the upgrade to the fixed release for your branch, prioritising internet-facing gateways.
  • Verify the affected and fixed versions directly in Juniper advisory JSA112177 before rollout.
  • Review whether the listed application services are really needed.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 03:07.

Original description (NVD)

A Missing Release of Memory after Effective Lifetime vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a complete Denial-of-Service (DoS). On SRX4000 Series, and SRX5000 Series with SPC3, and MX Series with SPC3, when one or more specific application services like ALGs, IDP/DPI, APPID, SECINTEL, AAMW or AppQoE are configured, a high connections per second churn will cause PFE memory to leak. If the memory is exhausted traffic processing will be impacted. Use the CLI command show security monitoring to monitor the memory utilization of the PFEs on the FPCs. This issue affects Junos OS on SRX Series and MX Series: * 23.4 versions from 23.4R2-S3 before 23.4R2-S7; * 24.2 versions from 24.2R2 before 24.2R2-S3; * 24.4 versions before 24.4R2-S3; * 25.2 versions before 25.2R1-S2, 25.2R2.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed