CVE-2026-21906

Name of the Vulnerable Software and Affected Versions Juniper Networks Junos OS on SRX Series versions prior to 21.4R3-S12 Juniper Networks Junos OS on SRX Series versions 22.4 before 22.4R3-S8 Juniper Networks Junos OS on SRX Series versions 23.2 before 23.2R2-S5 Juniper Networks Junos OS on SRX Series versions 23.4 before 23.4R2-S5 Juniper Networks Junos OS on SRX Series versions 24.2 before 24.2R2-S3 Juniper Networks Junos OS on SRX Series versions 24.4 before 24.4R2-S1 Juniper Networks Junos OS on SRX Series versions 25.2 before 25.2R1-S1 and 25.2R2

Description An improper handling of exceptional conditions exists in the packet forwarding engine (PFE) of Juniper Networks Junos OS on SRX Series. An unauthenticated network-based attacker can send a specific ICMP packet through a GRE tunnel, causing the PFE to crash and restart, resulting in traffic loss. This occurs when PowerMode IPsec (PMI) and GRE performance acceleration are enabled. PMI utilizes Vector Packet Processing to improve IPsec performance. The vulnerability is triggered by a specific ICMP packet received while PMI and GRE performance acceleration are active.

Recommendations Versions prior to 21.4R3-S12 should be updated. Versions 22.4 before 22.4R3-S8 should be updated. Versions 23.2 before 23.2R2-S5 should be updated. Versions 23.4 before 23.4R2-S5 should be updated. Versions 24.2 before 24.2R2-S3 should be updated. Versions 24.4 before 24.4R2-S1 should be updated. Versions 25.2 before 25.2R1-S1 and 25.2R2 should be updated.