Junos OS: malformed ICMPv6 packet during NAT64 translation crashes srxpfe repeatedly

CVSS 8.7CVE-2026-33790Firmware, BMC & network fabriccurated

Impact

During NAT64 translation, a specific malformed ICMPv6 packet addressed to the device crashes the srxpfe flow process and restarts it; continued packets keep it crashing and hold the denial of service open. srxpfe is the forwarding path, so while it is down the firewall is not passing traffic - for a GPU site behind an SRX that is a full connectivity outage covering tenant ingress, storage replication and management access, not a degraded mode. The trigger is narrow: only ICMPv6 during NAT64, not IPv4 and not other IPv6 traffic, so deployments without NAT64 configured are unaffected. Availability only.

Who can reach it

Network, unauthenticated: anyone who can send ICMPv6 to an affected SRX that has NAT64 configured. The packet must be destined to the device itself.

What to do

Upgrade Junos OS to 21.2R3-S10, 21.4R3-S12, 22.2R3-S8, 22.4R3-S9, 23.2R2-S6, 23.4R2-S7, 24.2R2-S3, 24.4R2-S3, or 25.2R1-S2 / 25.2R2 per Juniper JSA107874; 21.3 and 22.1 have no fixed release and need a move to a supported branch. The upgrade reloads the device - do it in a window, failing over the cluster peer first. Where NAT64 is not required, disabling it removes the exposure without an upgrade.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-33790 https://kb.juniper.net/JSA107874

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.