Log in Start free

Vulnerability · Published Jan 15, 2026 · Assigned by juniper

CVE-2026-21918Junos OS: SRX and MX Series: When TCP packets occur in a specific sequence flowd crashes

High 7.5

In plain English

A high-severity double free in Junos OS from Juniper Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.4%top 64.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A Double Free vulnerability in the flow processing daemon (flowd) of Juniper Networks Junos OS on SRX and MX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). On all SRX and MX Series platforms, when during TCP session establishment a specific sequence of packets is encountered a double free happens. This causes flowd to crash and the respective FPC to restart. This issue affects Junos OS on SRX and MX Series: * all versions before 22.4R3-S7, * 23.2 versions before 23.2R2-S3, * 23.4 versions before 23.4R2-S4, * 24.2 versions before 24.2R2.

Affected products (as reported)

VendorProductVersions
Juniper Networks Junos OS 0 – before 22.4R3-S723.2 – before 23.2R2-S323.4 – before 23.4R2-S424.2 – before 24.2R2

Weakness: CWE-415 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References