Log in Start free

Vulnerability · Published Oct 14, 2026 · Assigned by juniper

CVE-2026-102083Junos OS: SRX Series: With WebFiltering enabled prolonged HTTP session load can cause a crash

Medium 5.9

In plain English

A medium-severity security flaw in Junos OS from Juniper Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)0.3%top 75.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

An Improper Resource Locking vulnerability in the UTM processing of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). When UTM WebFiltering is configured and the WebFiltering cloud server is unreachable, sustained HTTP traffic load may cause the UTM subsystem to crash and restart, which will lead to a complete service outage until the system has recovered. When category lookup requests cannot be completed, they accumulate internally. Under high load and specific timing conditions, an invalid internal state can occur during cleanup of pending WebFiltering lookups, resulting in a crash of the UTM process. This issue applies to both NextGeneration WebFiltering (NGWF) and Enhanced WebFiltering (EWF). This issue affects Junos OS on SRX Series: * 23.2 versions from 23.2R2 before 23.2R2-S7.7; * 23.4 versions from 23.4R2 before 23.4R2-S8.13; * 24.2 versions before 24.2R2-S5.5; * 24.4 versions before 24.4R2-S4; * 25.2 versions before 25.2R2-S1; * 25.4 versions before 25.4R1-S3, 25.4R2.

Affected products (as reported)

VendorProductVersions
Juniper Networks Junos OS 23.2R2 – before 23.2R2-S7.723.4R2 – before 23.4R2-S8.1324.2 – before 24.2R2-S5.524.4 – before 24.4R2-S425.2 – before 25.2R2-S125.4 – before 25.4R1-S3, 25.4R2

Weakness: CWE-413 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References