CVE-2026-21918
HighSummary
A Double Free vulnerability in the flow processing daemon (flowd) of Juniper Networks Junos OS on SRX and MX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). On all SRX and MX Series platforms, when during TCP session establishment a specific sequence of packets is encountered, a double free happens. This causes flowd to crash and the respective FPC to restart. This issue affects Junos OS on SRX and MX Series: all versions before 22.4R3-S7, 23.2 versions before 23.2R2-S3, 23.4 versions before 23.4R2-S4, 24.2 versions before 24.2R2.
Risk Assessment
The risk is that an unauthenticated attacker can remotely cause flowd crashes and FPC restarts, leading to service disruptions and potential system unavailability.
Recommendation
It is recommended to upgrade Junos OS to patched versions as indicated by the vendor and monitor TCP traffic for suspicious packet sequences.
Other vulnerabilities in Juniper Networks Junos OS
See all- CVE-2026-21920High
An Unchecked Return Value vulnerability in the DNS module of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). If an SRX Series device configured for DNS processing receives a specifically formatted DNS request, flowd will crash and restart, which causes a service interruption until the process has recovered. This issue affects Junos OS on SRX Series: 23.4 versions before 23.4R2-S5, 24.2 versions before 24.2R2-S1, 24.4 versions before 24.4R2. This issue does not affect Junos OS versions before 23.4R1.
- CVE-2016-4924High
CVE-2016-4924 describes an incorrect permissions vulnerability in Junos OS on vMX that may allow local unprivileged users to access vMX or vPFE images and obtain sensitive information such as private cryptographic keys.
- CVE-2017-2348High
The Juniper Enhanced jdhcpd daemon may experience high CPU utilization or crash and restart upon receipt of an invalid IPv6 UDP packet. This can lead to DHCP service interruption, resulting in denial of service.
- CVE-2017-2314High
Receipt of a malformed BGP OPEN message may cause the routing protocol daemon (rpd) process to crash and restart. An attacker can repeatedly crash the rpd process, causing prolonged denial of service.
Original NVD description (English source)
A Double Free vulnerability in the flow processing daemon (flowd) of Juniper Networks Junos OS on SRX and MX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). On all SRX and MX Series platforms, when during TCP session establishment a specific sequence of packets is encountered a double free happens. This causes flowd to crash and the respective FPC to restart. This issue affects Junos OS on SRX and MX Series: * all versions before 22.4R3-S7, * 23.2 versions before 23.2R2-S3, * 23.4 versions before 23.4R2-S4, * 24.2 versions before 24.2R2.