Junos OS (SRX Series): Denial of Service via TLS session resumption in SSL proxy
Summary
Junos OS on SRX Series firewalls contains a flaw in the SSL plugin that can be triggered when ssl-proxy is configured. A network-based, unauthenticated attacker who sends a specifically malformed TLS message during a session-resumption attempt can crash the Packet Forwarding Engine (PFE). Traffic forwarding is lost temporarily until the PFE recovers automatically. Exposure depends on whether the SSL proxy is enabled and reachable.
Affected
- All versions before 23.2R2-S5
- 23.4 versions before 23.4R2-S5
- 24.2 versions before 24.2R2-S2
- 24.4 versions before 24.4R2
- Only relevant when ssl-proxy is configured
Fixed in
- 23.2R2-S5
- 23.4R2-S5
- 24.2R2-S2
- 24.4R2
- 25.2R1 and all later releases
Workaround
- Disable TLS session resumption in each SSL proxy profile: set services ssl proxy profile <profile> actions disable-session-resumption
- Check first that no application depends on session resumption.
Exploitation
- Juniper SIRT is not aware of any malicious exploitation.
- CISA SSVC: exploitation none, not automatable, partial technical impact.
- No public proof of concept found.
Our recommendation
- Check the configuration for 'services ssl proxy'. If it is not configured, the vulnerability does not apply.
- If it is configured, install the fixed Junos OS release in the next maintenance window, or apply the workaround as an interim measure.
- Plan for the temporary traffic loss on single-firewall sites without redundancy.
- Check the related SRX advisory for CVE-2026-102084, which is rated more severely.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Juniper security advisory JSA112176 supportportal.juniper.net
- Juniper security bulletin CVE-2026-102082 supportportal.juniper.net
- OpenCVE record CVE-2026-102082 app.opencve.io
- GovCERT.HK alert 2112 www.govcert.gov.hk
- Positive Technologies record PT-2026-113918 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 16:18.
Original description (NVD)
An Improper Handling of Missing Special Element vulnerability in the SSL plugin of Juniper Networks Junos OS on SRX Series allows a network-based, unauthenticated attacker to cause a Denial-of-Service (DoS). This issue is will occur when 'ssl-proxy' is configured on SRX platforms and during a TLS session-resumption attempt a specifically malformed TLS message is received. This results in an invalid pointer access and PFE crash which causes a temporary loss of traffic forwarding until the PFE automatically recovers. The exact internal timing to trigger this issue is outside the attacker's direct control.This issue affects Junos OS on SRX Series: * All versions before 23.2R2-S5; * 23.4 versions before 23.4R2-S5; * 24.2 versions before 24.2R2-S2; * 24.4 versions before 24.4R2.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.