Unpatched Juniper SRX Firewalls Risk Crash From Malformed IPv4 Packets
A critical heap overflow in the SVR component allows unauthenticated attackers to disrupt services on affected Junos OS versions via crafted network traffic.
Key points
- Juniper Networks issued a warning about a heap-based buffer overflow in the SVR component of Junos OS.
- The flaw allows unauthenticated remote attackers to cause denial of service or compromise data integrity.
- Affected systems include SRX Series devices running specific versions prior to recent service releases.
The SVR component in Juniper Networks Junos OS contains a heap-based buffer overflow that exposes SRX Series firewalls to remote disruption. According to the National Vulnerability Database, this flaw stems from how the software processes malformed IPv4 packets. If an interface is configured for Secure Vector Routing, these packets can trigger the overflow. This creates a pathway for unauthenticated network attackers to cause a denial of service and potentially compromise confidentiality and integrity.
Which Junos OS versions are at risk?
The vulnerability affects specific branches of Juniper Networks Junos OS. The NVD record lists affected versions as those before 23.2R2-S7.7, before 23.4R2-S8.13, before 24.2R2-S5.5, and before 24.4R2-S5. These versions run on SRX Series devices. The source material explicitly identifies these earlier builds as affected by the heap-based buffer overflow in the SVR component.
How severe is the threat to network operations?
The National Vulnerability Database rates CVE-2026-101950 as critical, assigning it CVSS scores of 9.8 and 9.3 in separate entries. The primary impact is denial of service. However, the description also notes that attackers could potentially compromise confidentiality and integrity. This means a successful exploit might allow an adversary to read protected information or modify system behavior, beyond just crashing the service.
What triggers the vulnerability in the SVR component?
The trigger is specific to the configuration of the firewall interface. The flaw occurs when an interface is configured for Secure Vector Routing. An attacker sends malformed IPv4 packets to this interface. The SVR component fails to handle the input correctly, leading to a heap-based buffer overflow identified as CWE-122. This weakness allows the unauthenticated attacker to cause a denial of service and potentially compromise confidentiality and integrity.
What is the current status of fixes?
The source material lists specific version thresholds that are affected, implying that versions after these thresholds are not. For example, versions after 23.2R2-S7.7 are not listed as vulnerable. However, the material does not explicitly state that a patch has been released for all affected branches or provide a direct download link. Users should verify if their current version is newer than the listed affected ranges. If a fix has been confirmed by the vendor, it would likely be included in the newer service releases mentioned.
What analysts watch for
Security teams monitoring for this type of infrastructure attack should examine firewall logs for spikes in malformed IPv4 traffic targeting specific interfaces. Analysts typically look for sudden service interruptions coinciding with unusual packet structures arriving at the network edge. Persistence checks involve verifying whether the system crashed or rebooted unexpectedly after processing these packets. Investigators should also review configuration files to identify which interfaces are enabled for Secure Vector Routing, as these are the primary targets for this specific exploitation pattern.
Background: National Vulnerability Database
The National Vulnerability Database lists known flaws but lacks deployment context. Do not treat every entry as an immediate emergency. Cross-reference findings with your asset inventory and usage patterns to determine real risk, rather than reacting to every new identifier.
Read the full guide: National Vulnerability Database: Five Common Misreadings and Fixes
What to do and how to stay safe: Juniper Networks
- Identify all SRX Series firewalls currently running Junos OS versions older than the safe thresholds listed in the NVD record.
- Review interface configurations to determine which ones are set up for Secure Vector Routing and isolate them if possible.
- Monitor network logs for abnormal IPv4 packet patterns that could indicate an attempt to trigger the buffer overflow.
- Plan to upgrade to the latest supported service release for your specific Junos OS branch once the vendor provides an update.
Step-by-step guide: How Vulnerability Scanning Works: The Hidden Mechanics and Limits
General security guidance from the Sandbox Desk newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is this vulnerability being actively exploited in the wild?
The source material does not state whether CVE-2026-101950 is currently being exploited in active attacks.
Do I need to disable Secure Vector Routing to stay safe?
The material does not advise disabling the feature, but notes that the flaw affects interfaces configured for it.
What is the CVSS score for this vulnerability?
The National Vulnerability Database lists CVSS scores of 9.8 and 9.3 for CVE-2026-101950.
