Main Vulnerability Database SB2026011988

SB2026011988 - Remote denial of service in Junos OS PFE

Published: January 19, 2026

Security Bulletin ID SB2026011988

CSH Severity

Medium

Patch available

YES

Number of vulnerabilities 1

Exploitation vector Remote access

Highest impact Denial of service

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 1 vulnerability.

1) Improper handling of exceptional conditions (CVE-ID: CVE-2026-21906)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper handling of exceptional conditions error in the packet forwarding engine (PFE) when PowerMode IPsec (PMI) and GRE performance acceleration are enabled. A remote non-authenticated attacker can cause the PFE to crash and restart by sending specially crafted ICMP packets.

Remediation

Install update from vendor's website.

References

https://supportportal.juniper.net/s/article/2026-01-Security-Bulletin-Junos-OS-SRX-Series-With-GRE-performance-acceleration-enabled-receipt-of-a-specific-ICMP-packet-causes-the-PFE-to-crash-CVE-2026-21906