Junos OS MX/SPC3: malformed IPv6 packets exhaust NAT sessions until the device is rebooted

CVSS 8.7CVE-2026-102077Firmware, BMC & network fabriccurated

Impact

On MX Series with an SPC3 line card and source NAT configured, a specific malformed IPv6 packet is not dropped - the PFE creates a session and allocates NAT resources for it. A sustained stream exhausts sessions or NAT pool resources and then all traffic through the device stops. Recovery requires a reboot, not a clear or a service restart, so a single unauthenticated sender can take out a device that an entire rack or cluster depends on for egress and keep it down until someone schedules the restart. Juniper gives monitoring commands: 'show services sessions summary' and 'show services nat pool'. Affects all versions before 23.2R2-S4, 23.4 before 23.4R2-S5, and 24.2 before 24.2R2.

Who can reach it

Unauthenticated, network-based - anyone who can get IPv6 packets to the NAT-configured interfaces of the affected MX device.

What to do

Upgrade to Junos OS 23.2R2-S4, 23.4R2-S5, 24.2R2 or later per Juniper JSA112182. The upgrade itself requires a device reboot, and a device already in the exhausted state needs a reboot to recover - treat both as planned maintenance per chassis. Until patched, watch session and NAT pool utilization with the commands above and filter untrusted IPv6 toward the NAT interfaces.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-102077 https://supportportal.juniper.net/JSA112182

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.