High priorityDisclosed

Advisory · CVE-2026-101955

Stack overflow in SRX UTM anti-spam lets a malformed DNS packet run code

A stack-based buffer overflow in the UTM Anti-Spam SBL of Junos OS on SRX Series lets an unauthenticated remote attacker execute arbitrary code or deny service with a malformed DNS packet when Anti-Spam SBL inspection is enabled. Juniper rates it CVSS 3.1 8.1 (CVSS 4.0 9.2).

Advisory published October 14, 2026Independent summary
Vendor
Juniper Networks
Product
Junos OS
Identifier / CWE
CVE-2026-101955
CWE-121
Action timing
Immediate
ELI5

Explain it like I’m five

The anti-spam check itself can be overflowed by the DNS answer it is inspecting, on the firewall, without any login.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Malformed DNS packet injected

    An unauthenticated attacker gets a crafted DNS packet into the Anti-Spam SBL inspection path.

  2. 02Stack overflows

    The SBL handling copies the packet data past its stack buffer.

  3. 03Code runs or service drops

    The overflow executes arbitrary code or denies service on the SRX.

What happened

Juniper disclosed CVE-2026-101955 in its October 2026 security release: a stack-based buffer overflow (CWE-121) in the UTM Anti-Spam SBL on SRX Series. A malformed DNS packet injected into the inspection path can execute arbitrary code or deny service when Anti-Spam SBL inspection is enabled.

Juniper’s JSA112186 lists the affected service releases and the October 2026 service release thresholds that carry the fix. Match your exact release to the advisory rather than guessing here.

What to do

  1. Inventory every Junos OS deployment, including test, training, and individually managed instances.
  2. Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
  3. Restrict network access to Junos OS while remediation is underway, especially for internet-facing instances.
  4. Review application and server logs for UTM or anti-spam process crashes and DNS responses with unusual lengths or records reaching SRX devices.
  5. Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
  6. Verify the deployed version or patch level after remediation.

Management note

Inspection features expand the attack surface of the box meant to shrink it. Patch SRX devices running UTM anti-spam first.