Vulnerability · Published Jul 9, 2026 · Assigned by juniper
CVE-2026-57021Junos OS: SRX Series: If VPN compliance-check is configured an attacker can cause http-gk process crash
Medium 5.3
In plain English
A medium-severity out-of-bounds write in Junos OS from Juniper Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).
Official description
An Out-of-bounds Write vulnerability in the http-gatekeeper (http-gk) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). If an SRX Series device is configured for remote-access VPN with pre-logon compliance check, a network-based attacker sending specifically formatted requests can trigger an out of bounds write leading to an http-gk process crash. This crash leads to unavailability of all services depending on the [ system services web-management ] configuration (like J-Web, remote access VPN and firewall authentication) until the process automatically restarts. This issue affects Junos OS on SRX Series: * 23.2 versions before 23.2R2-S7, * 23.4 versions before 23.4R2-S8, * 24.2 versions before 24.2R2-S4, * 24.4 versions before 24.4R2-S4, * 25.2 versions before 25.2R2, * 25.4 versions before 25.4R1-S1, 25.4R2.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Juniper Networks | Junos OS | 23.2 – before 23.2R2-S723.4 – before 23.4R2-S824.2 – before 24.2R2-S424.4 – before 24.4R2-S425.2 – before 25.2R225.4 – before 25.4R1-S1, 25.4R2 |
Weakness: CWE-787 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
References
- https://supportportal.juniper.net/JSA110081 vendor-advisory