Junos OS on SRX: heap overflow in the SVR path lets unauthenticated IPv4 packets crash or compromise the firewall

CVSS 9.3CVE-2026-101950Firmware, BMC & network fabriccurated

Impact

An unauthenticated attacker who can land malformed IPv4 packets on an interface configured for Secure Vector Routing triggers a heap-based buffer overflow in the SVR component. The advisory states this causes denial of service and can also affect confidentiality and integrity, so a crafted packet stream can both drop the data path and potentially corrupt state inside the firewall. On an SRX that sits in front of a GPU fleet, that means the north-south path to every tenant and to the storage and management networks behind it goes down at an attacker's choosing, and the device cannot be trusted afterwards. No authentication and no user interaction are required (CVSS 4.0 AV:N/PR:N/UI:N), which makes this reachable from any network that can route packets to an SVR-enabled interface.

Who can reach it

Network, unauthenticated. Anyone who can send IPv4 packets to an interface on which Secure Vector Routing is configured. Devices with no SVR configuration are not exposed via this path.

What to do

Upgrade Junos OS on affected SRX Series devices per Juniper advisory JSA112186; the NVD record does not list the fixed releases, so read the bulletin for the exact target version for your train. Until then, the exposure is tied to SVR being configured on a reachable interface, so removing or filtering access to SVR interfaces limits it. A Junos upgrade reloads the device: fail traffic over to the redundant chassis or schedule a window, because an SRX reboot takes the whole path through it offline.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-101950 https://supportportal.juniper.net/JSA112186

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.