Act nowDisclosed

Advisory · CVE-2026-101950

Heap overflow in Junos OS SVR on SRX can let malformed IPv4 packets compromise the firewall

A heap-based buffer overflow in the Secure Vector Routing (SVR) component of Junos OS on SRX Series lets an unauthenticated network attacker cause a denial of service and potentially compromise confidentiality and integrity with malformed IPv4 packets. Juniper rates it CVSS 3.1 9.8 (CVSS 4.0 9.3).

Advisory published October 14, 2026Independent summary
Vendor
Juniper Networks
Product
Junos OS
Identifier / CWE
CVE-2026-101950
CWE-122
Action timing
Immediate
ELI5

Explain it like I’m five

A firewall component that inspects packets can be overflowed by the packets themselves, so the guard can be taken over by the traffic it was guarding.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Malformed packet arrives

    An unauthenticated attacker sends crafted IPv4 packets to an SRX interface configured for Secure Vector Routing.

  2. 02SVR heap overflows

    The SVR component copies packet data past its heap buffer.

  3. 03Device compromised or down

    The overflow can deny service and potentially compromise the device's confidentiality and integrity.

What happened

Juniper disclosed CVE-2026-101950 in its October 2026 security release: a heap-based buffer overflow (CWE-122) in the SVR component of Junos OS on SRX Series. Malformed IPv4 packets reaching an interface configured for Secure Vector Routing can trigger it without authentication. The vendor record lists service releases before the October 2026 thresholds, starting with releases before 23.2R2-S7.7, as affected.

Juniper’s JSA112186 lists the affected service releases and the October 2026 service release thresholds that carry the fix. Match your exact release to the advisory rather than guessing here.

What to do

  1. Inventory every Junos OS deployment, including test, training, and individually managed instances.
  2. Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
  3. Restrict network access to Junos OS while remediation is underway, especially for internet-facing instances.
  4. Review application and server logs for SRX crashes or restarts tied to unusual IPv4 traffic and SVR-enabled interfaces behaving unexpectedly.
  5. Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
  6. Verify the deployed version or patch level after remediation.

Management note

An unauthenticated overflow in a firewall data path is as bad as perimeter flaws get. Patch SRX devices on the urgent ring and check which interfaces actually run SVR.