« Volver al listado

CVE-2026-57030

Estado: AnalizadaAlta (8.2)—

A Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).

As part of the stateful traffic processing on SRX Series devices flows are being established, and removed when not needed anymore. During the removal process the timeout of a flow should be set to 3 seconds and consequentially the flow should be removed shortly after. Due to a race condition occurring when setting the timeout there is a chance (the exact conditions are outside the attackers control) that the timeout is instead set to a very high value of larger than 10,000 seconds:

Leer descripción completaMostrar menos

user@host> show security flow session | match timeout Session ID: 98784248524, Policy name: PROD-FLOW/4, HA State: Active, Timeout: 85250, Session State: Valid

This will lead to an accumulation of flows which can be observed by an ever-increasing value of invalidated sessions in the output of 'show security flow session summary':

user@host> show security flow session summary | match invalid Invalidated sessions: 216931These sessions can't be cleared manually with the 'clear security flow session' command, which will either lead to forwarding to stop (and the system needs to be manually recovered with a reboot) or to a flowd core and automatic reboot.

This issue affects Junos OS on SRX Series:

Detalles técnicos trazas, registros y código del informe original
  *  24.2 versions before 24.2R2-S3,
  *  24.4 versions before 24.4R2-S1, 24.4R2-S2,
  *  25.2 versions before 25.2R1-S2, 25.2R2.

This issue does not affect releases earlier than 24.2R1;

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Race condition en PFE de Junos (AV:N, sin autenticación) causa acumulación de flujos y DoS; impacto primario es negación de servicio (T1499.004 endpoint DoS), secundario escalada implícita (reboot/recuperación manual sugiere control de sistema).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network TrafficApplication Isolation and SandboxingExploit ProtectionUpdate SoftwareVulnerability ScanningThreat Intelligence Program

Tecnologías afectadas (1)

Juniper — Junos

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-57030",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-57030",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-07-10T14:42:22.610309Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "sirt@juniper.net",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.2
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "sirt@juniper.net",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "USER",
          "baseScore": 8.2,
          "Automatable": "YES",
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:M/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "LOW",
          "vulnAvailabilityImpact": "HIGH",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "MODERATE",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "sirt@juniper.net",
      "affectedData": [
        {
          "vendor": "Juniper Networks",
          "product": "Junos OS",
          "versions": [
            {
              "status": "affected",
              "version": "24.2",
              "lessThan": "24.2R2-S3",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "24.4",
              "lessThan": "24.4R2-S1",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "25.2",
              "lessThan": "25.2R1-S2",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "24.2R1",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "SRX Series"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-07-09T22:17:08.643",
  "references": [
    {
      "url": "https://supportportal.juniper.net/JSA110090",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "sirt@juniper.net"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "sirt@juniper.net",
      "description": [
        {
          "lang": "en",
          "value": "CWE-362"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).\n\nAs part of the stateful traffic processing on SRX Series devices flows are being established, and removed when not needed anymore. During the removal process the timeout of a flow should be set to 3 seconds and consequentially the flow should be removed shortly after. Due to a race condition occurring when setting the timeout there is a chance (the exact conditions are outside the attackers control) that the timeout is instead set to a very high value of larger than 10,000 seconds:\n\n\n\nuser@host> show security flow session | match timeout\nSession ID: 98784248524, Policy name: PROD-FLOW/4, HA State: Active, Timeout: 85250, Session State: Valid\n\nThis will lead to an accumulation of flows which can be observed by an ever-increasing value of invalidated sessions in the output of 'show security flow session summary':\n\nuser@host> show security flow session summary | match invalid\nInvalidated sessions: 216931These sessions can't be cleared manually with the 'clear security flow session' command, which will either lead to forwarding to stop (and the system needs to be manually recovered with a reboot) or to a flowd core and automatic reboot.\n\n\nThis issue affects Junos OS on SRX Series:\n\n\n  *  24.2 versions before 24.2R2-S3,\n  *  24.4 versions before 24.4R2-S1, 24.4R2-S2,\n  *  25.2 versions before 25.2R1-S2, 25.2R2.\n\n\n\n\nThis issue does not affect releases earlier than 24.2R1;"
    }
  ],
  "lastModified": "2026-07-13T20:16:07.750",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:juniper:junos:24.2:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "89524D6D-0B22-4952-AD8E-8072C5A05D5C"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:24.2:r1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AD69A194-1B03-44EA-8092-79BD10C6F729"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:24.2:r1-s1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8463ADB4-B8A7-4D63-97A9-232ED713A21C"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:24.2:r1-s2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FE68337F-106E-4317-A5B6-292B0159F577"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:24.2:r2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "266B520A-482A-43F7-90F8-B9D64D30034F"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:24.2:r2-s1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AC78BC9E-5DA7-4E42-9923-B49A0B7F3564"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:24.2:r2-s2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DD99F1B0-82B0-4CD3-8C8F-C0FFF44A8B90"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:24.4:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C452BDCB-34E3-42D3-8909-2312356EB70A"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:24.4:r1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2B8158F2-2028-40E9-955F-CFD581A32F60"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:24.4:r1-s2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1A7233A1-EC7A-4458-9AE1-835480A03A21"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:24.4:r1-s3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D74087E2-5CAA-4085-8408-EB70EC1D5D91"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:24.4:r2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0EEF1798-F3C2-4645-96E7-1E82368B184D"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:25.2:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1B7572BB-9C77-4214-9C5F-CC83C7B93E37"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:25.2:r1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CAADBF98-38BE-40E2-AF1B-9077DCED0809"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:25.2:r1-s1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "558F0A4C-0C72-4BF1-B2DE-C0D3BFD54BCD"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:juniper:srx1500:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "2CEBF85C-736A-4E7D-956A-3E8210D4F70B"
            },
            {
              "criteria": "cpe:2.3:h:juniper:srx1600:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "4AE06B18-BFB5-4029-A05D-386CFBFBF683"
            },
            {
              "criteria": "cpe:2.3:h:juniper:srx2300:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "48A1DCCD-208C-46D9-8E14-89592B49AB9A"
            },
            {
              "criteria": "cpe:2.3:h:juniper:srx300:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "BB5AB24B-2B43-43DD-AE10-F758B4B19F2A"
            },
            {
              "criteria": "cpe:2.3:h:juniper:srx320:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "80F9DC32-5ADF-4430-B1A6-357D0B29DB78"
            },
            {
              "criteria": "cpe:2.3:h:juniper:srx340:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "8B82D4C4-7A65-409A-926F-33C054DCBFBA"
            },
            {
              "criteria": "cpe:2.3:h:juniper:srx345:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "CE535749-F4CE-4FFA-B23D-BF09C92481E5"
            },
            {
              "criteria": "cpe:2.3:h:juniper:srx380:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "2305DA9D-E6BA-48F4-80CF-9E2DE7661B2F"
            },
            {
              "criteria": "cpe:2.3:h:juniper:srx400:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "460EE132-9BBF-49F2-9569-1B5D0ADCBA1E"
            },
            {
              "criteria": "cpe:2.3:h:juniper:srx4100:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "3AA8999C-8AE4-416F-BA2A-B1A21F33B4D7"
            },
            {
              "criteria": "cpe:2.3:h:juniper:srx4120:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "E5942B6E-AFC7-40E4-8007-68C804BD52E3"
            },
            {
              "criteria": "cpe:2.3:h:juniper:srx4200:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "CCC5F6F5-4347-49D3-909A-27A3A96D36C9"
            },
            {
              "criteria": "cpe:2.3:h:juniper:srx4300:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "826F893F-7B06-43B5-8653-A8D9794C052E"
            },
            {
              "criteria": "cpe:2.3:h:juniper:srx440:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "3E15DA7D-AED1-4943-9AEF-565D551311A5"
            },
            {
              "criteria": "cpe:2.3:h:juniper:srx4600:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "56BA6B86-D3F4-4496-AE46-AC513C6560FA"
            },
            {
              "criteria": "cpe:2.3:h:juniper:srx4700:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "462CFD52-D3E2-4F7A-98AC-C589D2420556"
            },
            {
              "criteria": "cpe:2.3:h:juniper:srx5400:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "2FDDC897-747F-44DD-9599-7266F9B5B7B1"
            },
            {
              "criteria": "cpe:2.3:h:juniper:srx5600:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "68CA098D-CBE4-4E62-9EC0-43E1B6098710"
            },
            {
              "criteria": "cpe:2.3:h:juniper:srx5800:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "66F474D4-79B6-4525-983C-9A9011BD958B"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "sirt@juniper.net"
}