Junos OS SRX/MX with SPC3: PFE memory leak under connection churn causes complete traffic loss

CVSS 8.7CVE-2026-102081Firmware, BMC & network fabriccurated

Impact

With one or more application services configured - ALGs, IDP/DPI, APPID, SECINTEL, AAMW or AppQoE - a high connections-per-second churn leaks PFE memory on SRX4000 Series, SRX5000 Series with SPC3 and MX Series with SPC3. Once memory is exhausted the device stops processing traffic, a complete denial of service for everything behind it. This is distinct from the session-exhaustion bug in the same release train: the trigger here is ordinary connection volume, which means a busy fleet can walk into it without anyone attacking, and a GPU cluster's bursty east-west and egress patterns are exactly that kind of churn. Monitor with 'show security monitoring' for PFE memory utilization on the FPCs. Affects 23.4 from 23.4R2-S3 before 23.4R2-S7, 24.2 from 24.2R2 before 24.2R2-S3, 24.4 before 24.4R2-S3, and 25.2 before 25.2R1-S2 / 25.2R2.

Who can reach it

Unauthenticated, network-based - any source able to drive a high rate of new connections through the device's service-enabled paths.

What to do

Upgrade to Junos OS 23.4R2-S7, 24.2R2-S3, 24.4R2-S3, 25.2R1-S2 / 25.2R2 or later per Juniper JSA112177. Expect a reboot per chassis for the upgrade, and a reboot to recover a device whose PFE memory is already exhausted. Until then, track PFE memory with 'show security monitoring' and consider which application services are genuinely needed on the affected line cards.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-102081 https://supportportal.juniper.net/JSA112177

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.