PT-2026-3118 · Juniper Networks · Junos

Published 2026-01-15 · Updated 2026-01-16 · CVE-2026-21903

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Juniper Networks Junos OS versions prior to 22.4R3-S7 Juniper Networks Junos OS versions prior to 23.2R2-S4 Juniper Networks Junos OS versions prior to 23.4R2

Description A Stack-based Buffer Overflow exists in the Packet Forwarding Engine (pfe) of Junos OS. A network-based attacker with low privileges can trigger a Denial-of-Service (DoS). Subscribing to telemetry sensors at scale causes all Flexible Packet Control (FPC) connections to drop, leading to an FPC crash and restart. The issue does not occur when YANG packages for the specific sensors are installed.

Recommendations Update to Junos OS version 22.4R3-S7 or later. Update to Junos OS version 23.2R2-S4 or later. Update to Junos OS version 23.4R2 or later.

Fix

DoS

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

CVE-2026-21903

Affected Products

Junos

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-21903 · Security Note
• https://osv.dev/vulnerability/CVE-2026-21903 · Vendor Advisory
• https://supportportal.juniper.net/JSA106022 · Vendor Advisory
• https://kb.juniper.net/JSA106022 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/2011958893618835832 · Twitter Post
• https://twitter.com/CVEnew/status/2011926048628490256 · Twitter Post