Juniper Junos OS on SRX Series: NULL pointer dereference in DNS plugin causes DoS
Summary
A NULL pointer dereference in the DNS plugin of Junos OS on SRX Series firewalls can crash the flowd process and cause a complete denial of service. An unauthenticated, network-based attacker can trigger it by sending multiple DNS queries in one flow session, where one query matches a SecIntel feed and another is sent for DGA analysis. The timing conditions are outside the attacker's direct control.
Affected
- Junos OS on SRX Series, all versions before 23.2R2-S7.7
- Junos OS on SRX Series, 23.4 before 23.4R2-S8.13
- Junos OS on SRX Series, 24.2 before 24.2R2-S5.5
- Junos OS on SRX Series, 24.4 before 24.4R2-S4
- Junos OS on SRX Series, 25.2 before 25.2R2-S1
- Junos OS on SRX Series, 25.4 before 25.4R1-S2
- Default configuration is unaffected; the vulnerable path requires SecIntel or DNS security logging to be configured
Fixed in
- 23.2R2-S7.7
- 23.4R2-S8.13
- 24.2R2-S5.5
- 24.4R2-S4
- 25.2R2-S1
- 25.4R1-S2
- 26.2R1 and all subsequent releases
- Note: releases 23.2, 23.4 and 24.2 were rebuilt (respins); some builds keep the same version string, so check JSA112170 for rebuild details
Workaround
- No known workarounds from Juniper.
- If the upgrade cannot be applied immediately, Juniper advises turning off the logging (for example the notification log of the security-metadata-streaming DNS detections policy and the log action of the security-intelligence profile rule), if this logging is not strictly required. Weigh the loss of visibility before doing this.
Exploitation
- Juniper SIRT is not aware of any malicious exploitation.
- CISA SSVC: exploitation none, not automatable, partial technical impact.
- No public proof of concept found in the sources reviewed; this does not prove that none exists.
- Not listed in CISA KEV according to a third-party source; not verified directly.
Our recommendation
- Identify SRX devices running affected Junos OS versions and check whether SecIntel or DNS security logging is enabled.
- Upgrade to a fixed release (23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S4, 25.2R2-S1, 25.4R1-S2, 26.2R1 or later) and verify the rebuild details in JSA112170.
- If patching is delayed, disable the affected logging as described in the workaround and accept the reduced visibility temporarily.
- Monitor the devices for unexpected flowd or FPC restarts and review the JSA for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Juniper Security Advisory JSA112170 supportportal.juniper.net
- VulDB entry CVE-2026-102086 vuldb.com
- OpenCVE CVE-2026-102086 app.opencve.io
- Tenable plugin 365674 www.tenable.com
- Vulners Nessus mirror of JUNIPER_JSA112170 vulners.com
- Strix CVE-2026-102086 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 16:23.
Original description (NVD)
A NULL Pointer Dereference vulnerability in the DNS plugin of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a complete Denial-of-Service (DoS). When multiple DNS queries are received in a single flow session, where one query matches a Security Intelligence (SecIntel) feed and another query is sent for DNS Domain Generation Algorithm (DGA) analysis, an error in processing logging of these asynchronous tasks can lead to an FPC crash. The exact timing conditions are outside an attacker's direct control. This issue affects Junos OS on SRX Series: * All versions before 23.2R2-S7.7; * from 23.4 before 23.4R2-S8.13; * from 24.2 before 24.2R2-S5.5; * from 24.4 before 24.4R2-S4; * from 25.2 before 25.2R2-S1; * from 25.4 before 25.4R1-S2.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.