Product:
Junos OS
Summary
A Double Free vulnerability in the flow processing daemon of Juniper Networks Junos OS on SRX and MX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service. During TCP session establishment, a specific sequence of packets can trigger a double free, causing flowd to crash and the respective FPC to restart. This vulnerability affects multiple versions of Junos OS on SRX and MX Series platforms.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.7 | CVE-2026-21918 |
Exploitation
To exploit this vulnerability, an attacker needs to send a specific sequence of packets during the TCP session establishment phase. This sequence triggers the double free condition in the flow processing daemon, leading to a crash of the flowd process and a subsequent restart of the affected FPC. The attacker does not require any authentication or special privileges to carry out this attack, making it particularly dangerous.
Affected Products
- Junos OS on SRX Series: All versions before 22.4R3-S7
- Junos OS on MX Series: 23.2 versions before 23.2R2-S3
- Junos OS on MX Series: 23.4 versions before 23.4R2-S4
- Junos OS on MX Series: 24.2 versions before 24.2R2
Mitigation
To mitigate this vulnerability, it is recommended to upgrade to the latest versions of Junos OS that are not affected by this issue. Regularly applying security patches and updates can help protect against potential exploits. Additionally, monitoring network traffic for unusual patterns may help in early detection of attempts to exploit this vulnerability.