← Back

CVE-2026-21918

nvd nist
Published: Jan 15, 2026Modified: Jun 17, 2026

JSON object

Loading...
8.7
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:X/RE:M/U:X
Show more
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:X/RE:M/U:XShow less
Source: sirt@juniper.net (Secondary)

Description

A Double Free vulnerability in the flow processing daemon (flowd) of Juniper Networks Junos OS on SRX and MX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). On all SRX and MX Series platforms, when during TCP session establishment a specific sequence of packets is encountered a double free happens. This causes flowd to crash and the respective FPC to restart. This issue affects Junos OS on SRX and MX Series: * all versions before 22.4R3-S7, * 23.2 versions before 23.2R2-S3, * 23.4 versions before 23.4R2-S4, * 24.2 versions before 24.2R2.

Affected (34)

Products: Juniper: Junos
Juniper
1 product
Junos
Configuration A
34 vulnerable · 27 platform
Vulnerable SoftwareAffected Versions
Juniper
Junos
Before 22.4
Junos
Version 22.4
Junos
Version 22.4 r1-s1
Junos
Version 22.4 r1-s2
Junos
Version 22.4 r1
Junos
Version 22.4 r2-s1
Junos
Version 22.4 r2-s2
Junos
Version 22.4 r2
Junos
Version 22.4 r3-s1
Junos
Version 22.4 r3-s2
Junos
Version 22.4 r3-s3
Junos
Version 22.4 r3-s4
Junos
Version 22.4 r3-s5
Junos
Version 22.4 r3-s6
Junos
Version 22.4 r3
Junos
Version 23.2
Junos
Version 23.2 r1-s1
Junos
Version 23.2 r1-s2
Junos
Version 23.2 r1
Junos
Version 23.2 r2-s1
Junos
Version 23.2 r2-s2
Junos
Version 23.2 r2
Junos
Version 23.4
Junos
Version 23.4 r1-s1
Junos
Version 23.4 r1-s2
Junos
Version 23.4 r1
Junos
Version 23.4 r2-s1
Junos
Version 23.4 r2-s2
Junos
Version 23.4 r2-s3
Junos
Version 23.4 r2
Junos
Version 24.2
Junos
Version 24.2 r1-s1
Junos
Version 24.2 r1-s2
Junos
Version 24.2 r1
Running on/withPlatform Versions
Juniper
Mx10004
All versions
Juniper
Mx10008
All versions
Juniper
Mx2008
All versions
Juniper
Mx2010
All versions
Juniper
Mx2020
All versions
Juniper
Mx204
All versions
Juniper
Mx240
All versions
Juniper
Mx304
All versions
Juniper
Mx480
All versions
Juniper
Mx960
All versions
Juniper
Srx1500
All versions
Juniper
Srx1600
All versions
Juniper
Srx2300
All versions
Juniper
Srx300
All versions
Juniper
Srx320
All versions
Juniper
Srx340
All versions
Juniper
Srx345
All versions
Juniper
Srx380
All versions
Juniper
Srx4100
All versions
Juniper
Srx4120
All versions
Juniper
Srx4200
All versions
Juniper
Srx4300
All versions
Juniper
Srx4600
All versions
Juniper
Srx4700
All versions
Juniper
Srx5400
All versions
Juniper
Srx5600
All versions
Juniper
Srx5800
All versions

Related CWEs

CWE-415
Double Free
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.

References (2)

Source: sirt@juniper.net
Vendor Advisory
Source: sirt@juniper.net
Vendor Advisory

Timeline

No history available yet.