CVE-2026-21906
HighSummary
A vulnerability in the packet forwarding engine (PFE) of Junos OS on SRX Series allows an unauthenticated network-based attacker to send a specific ICMP packet through a GRE tunnel, causing the PFE to crash and restart. The issue occurs when PowerMode IPsec (PMI) and GRE performance acceleration are enabled, leading to traffic loss.
Risk Assessment
The attack can cause network service disruption (traffic loss) on SRX devices, impacting infrastructure availability. The attack requires no authentication, increasing the risk of remote exploitation.
Recommendation
Upgrade Junos OS to a patched version (e.g., 21.4R3-S12 or later, 22.4R3-S8, 23.2R2-S5, 23.4R2-S5, 24.2). If immediate upgrade is not possible, consider disabling GRE acceleration (if feasible) and monitor traffic.
Other vulnerabilities in Juniper Junos OS
See all- CVE-2026-21908High
A Use After Free vulnerability was identified in the 802.1X authentication daemon (dot1xd) of Juniper Networks Junos OS and Junos OS Evolved. An authenticated, network-adjacent attacker can flap a port to crash the dot1xd process, leading to a Denial of Service (DoS), or potentially execute arbitrary code as root. The issue occurs during processing of a change of authorization (CoA) when a port bounce happens, where a freed pointer is later referenced.
- CVE-2016-1278High
Junos OS versions before 12.1X46-D50 on SRX Series devices revert to 'safe mode' after a failed upgrade to 12.1X46, allowing root CLI logins without a password. This may allow local users to gain privileges by leveraging the 'request system software' command with the 'partition' option.
- CVE-2016-1271High
In Juniper Junos OS versions before 12.1X46-D45, 12.1X47-D30, 12.3R11, 12.3X48-D25, 13.2R8, 13.3R7, 14.1R6, 14.2R4, 15.1R1, 15.1F2, and 15.1X49-D15, a vulnerability allows local users to gain privileges via crafted combinations of CLI commands and arguments. This is a different vulnerability than CVE-2015-3003, CVE-2014-3816, and CVE-2014-0615.
- CVE-2016-1264High
A race condition in the Op command in Juniper Junos OS allows remote authenticated users to gain privileges via the URL option. This affects versions before 12.1X44-D55, 12.1X46 before 12.1X46-D40, 12.1X47 before 12.1X47-D25, and other listed versions.
- CVE-2014-6450High
In Juniper Junos OS versions before 11.4R12-S4, 12.1X44-D41, 12.1X46-D26, 12.1X47-D11/D15, 12.2R9, 12.2X50-D70, 12.3R8, 12.3X48-D10, 12.3X50-D42, 13.1R4-S3, 13.1X49-D42, 13.1X50-D30, 13.2R6, 13.2X51-D26, 13.2X52-D15, 13.3R3-S3, 14.1R3, 14.2R1, 15.1R1, and 15.1X49-D10, when configured for IPv6, remote attackers can cause a denial of service (mbuf chain corruption and kernel panic) via crafted IPv6 packets.
- CVE-2015-5359High
A vulnerability in Juniper Junos OS allows remote attackers to cause a denial of service by sending a large number of BGP-VPLS advertisements with updated BGP local preference values. This affects multiple versions of the OS before their respective patches.
- CVE-2015-5358High
A vulnerability in Juniper Junos OS allows remote attackers to cause a denial of service by sending a large number of requests, triggering a TCP connection to move to the LAST_ACK state while there is more data to send.
- CVE-2014-3818High
In Juniper Junos OS versions from 9.1 to 14.1 before specific updates, a vulnerability exists that allows remote attackers to cause a denial of service through crafted transitive attributes in a BGP UPDATE. This can lead to memory corruption and a crash and restart of the RDP routing process.
Original NVD description (English source)
An Improper Handling of Exceptional Conditions vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on SRX Series allows an unauthenticated network-based attacker sending a specific ICMP packet through a GRE tunnel to cause the PFE to crash and restart. When PowerMode IPsec (PMI) and GRE performance acceleration are enabled and the device receives a specific ICMP packet, a crash occurs in the SRX PFE, resulting in traffic loss. PMI is enabled by default, and GRE performance acceleration can be enabled by running the configuration command shown below. PMI is a mode of operation that provides IPsec performance improvements using Vector Packet Processing. Note that PMI with GRE performance acceleration is only supported on specific SRX platforms. This issue affects Junos OS on the SRX Series: * all versions before 21.4R3-S12, * from 22.4 before 22.4R3-S8, * from 23.2 before 23.2R2-S5, * from 23.4 before 23.4R2-S5, * from 24.2 before 24.2