Junos OS: malformed TCP header in a proxied flow crashes flowd and drops all forwarding

CVSS 8.7CVE-2026-57023Firmware, BMC & network fabriccurated

Impact

When the TCP proxy is engaged in a flow session - which it is whenever ALGs, Advanced Anti-Malware, ICAP or UTM are in use - a TCP packet with a specifically malformed header crashes the flow processing daemon and restarts it, taking the forwarding plane down until automatic recovery completes. Any operator running an SRX or SPC3-equipped MX with those security services in front of a GPU site loses all traffic through that device during the crash, including tenant ingress and management paths, and a repeating attacker can hold the outage open. Availability only; nothing in the advisory indicates disclosure or code execution.

Who can reach it

Network, unauthenticated: any sender whose traffic traverses a flow session where the TCP proxy is engaged. Only devices with ALG, AAMW, ICAP or UTM configured are exposed; releases before 23.4R1 are not affected.

What to do

Upgrade Junos OS to 23.4R2-S7, 24.2R2-S4, 24.4R2-S3, or 25.2R2 per Juniper JSA110083. The upgrade reloads the device, so use a maintenance window and fail over the cluster peer. If a service can be spared, disabling the features that engage the TCP proxy removes the exposure in the meantime.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-57023 https://supportportal.juniper.net/JSA110083

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.