CVE-2026-101986

An Unchecked Return Value vulnerability in the DNS module of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). If an SRX Series device configured for DNS processing receives a specifically formatted DNS request, flowd will crash and restart, which causes a service interruption until the process has recovered. This issue affects Junos OS on SRX Series: 23.4 versions before 23.4R2-S5, 24.2 versions before 24.2R2-S1, 24.4 versions before 24.4R2. This issue does not affect Junos OS versions before 23.4R1.

A Double Free vulnerability in the flow processing daemon (flowd) of Juniper Networks Junos OS on SRX and MX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). On all SRX and MX Series platforms, when during TCP session establishment a specific sequence of packets is encountered, a double free happens. This causes flowd to crash and the respective FPC to restart. This issue affects Junos OS on SRX and MX Series: all versions before 22.4R3-S7, 23.2 versions before 23.2R2-S3, 23.4 versions before 23.4R2-S4, 24.2 versions before 24.2R2.

CVE-2016-4924 describes an incorrect permissions vulnerability in Junos OS on vMX that may allow local unprivileged users to access vMX or vPFE images and obtain sensitive information such as private cryptographic keys.

The Juniper Enhanced jdhcpd daemon may experience high CPU utilization or crash and restart upon receipt of an invalid IPv6 UDP packet. This can lead to DHCP service interruption, resulting in denial of service.

Receipt of a malformed BGP OPEN message may cause the routing protocol daemon (rpd) process to crash and restart. An attacker can repeatedly crash the rpd process, causing prolonged denial of service.

A stack-based buffer overflow vulnerability in the srxpfe process of Juniper Networks Junos OS on SRX Series allows an unauthenticated network attacker to execute code as root or cause a denial of service via a crafted packet received on a configured GRE tunnel.

A stack-based buffer overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated BGP peer to cause a denial of service and potential root-level command execution via crafted BGP route updates when the BGP Monitoring Protocol (BMP) is enabled.

A stack-based buffer overflow vulnerability in the kmd component of Juniper Networks Junos OS on MX Series allows an unauthenticated network attacker to execute code as root via specific IKE certificate-based packets. This issue affects Junos OS on MX Series in versions before 21.2R3-S11, from 21.4 before 21.4R3-S12, from 22.2 before 22.2R3-S8, from 22.3 before 22.3R3-S5, and from 22.4 before 22.4R3-S9.

A stack-based buffer overflow vulnerability in the BGP routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP flowspec peer to cause routing-engine compromise or a routing-daemon denial of service via flowspec route re-advertisement when BGP update-threading is enabled.

A heap-based buffer overflow vulnerability in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated attacker who can control or intercept the configured SDX/SRC server connection to execute code as root or cause denial of service via a crafted frame received over the service-deployment TCP connection.