Product:
Junos OS
Summary
An Improper Handling of Exceptional Conditions vulnerability in the packet forwarding engine of Junos OS on SRX Series allows an unauthenticated network-based attacker to send a specific ICMP packet through a GRE tunnel, causing the PFE to crash and restart. This results in traffic loss when PowerMode IPsec and GRE performance acceleration are enabled. PMI is enabled by default, and GRE performance acceleration can be configured on specific SRX platforms.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.7 | CVE-2026-21906 |
Exploitation
To exploit this vulnerability, an attacker must send a specially crafted ICMP packet through a GRE tunnel to a vulnerable SRX device with PowerMode IPsec and GRE performance acceleration enabled. This will trigger a crash in the packet forwarding engine, leading to a denial of service and loss of traffic.
Affected Products
- All versions before 21.4R3-S12
- From 22.4 before 22.4R3-S8
- From 23.2 before 23.2R2-S5
- From 23.4 before 23.4R2-S5
- From 24.2 before 24.2R2-S3
- From 24.4 before 24.4R2-S1
- From 25.2 before 25.2R1-S1
Mitigation
To mitigate this vulnerability, users should disable PowerMode IPsec and GRE performance acceleration on affected SRX devices or upgrade to a version of Junos OS that is not vulnerable. Regularly updating the software and monitoring for unusual traffic patterns can also help in reducing the risk of exploitation.