High · published January 15, 2026
🚨 A specific ICMP packet is all it takes to crash the packet forwarding engine of Juniper’s SRX Series running Junos OS! ⚡ This vulnerability is lurking in your network, and it’s time to get serious about patching! Think of the PFE as a high-speed train with a faulty signal. If an incorrect signal (the ICMP packet) gets through, it causes the whole system to stop abruptly, leading to chaos on the tracks—traffic loss in your network! An unauthenticated attacker can send this problematic ICMP packet through a GRE tunnel, causing the PFE to crash and restart. This leads to traffic loss, which could disrupt services and create a vulnerability for further attacks—absolutely devastating for any organization relying on constant connectivity!
Think of the PFE as a high-speed train with a faulty signal. If an incorrect signal (the ICMP packet) gets through, it causes the whole system to stop abruptly, leading to chaos on the tracks—traffic loss in your network! This vulnerability arises from improper handling of exceptional conditions in the PFE of Junos OS. When PowerMode IPsec and GRE acceleration are enabled, certain ICMP packets can trigger a crash of the engine.
An unauthenticated attacker can send this problematic ICMP packet through a GRE tunnel, causing the PFE to crash and restart. This leads to traffic loss, which could disrupt services and create a vulnerability for further attacks—absolutely devastating for any organization relying on constant connectivity! To protect your network, update to Junos OS 21.4R3-S12 or later, or for the other affected versions, ensure you upgrade to 22.4R3-S8, 23.2R2-S5, 23.4R2-S5, 24.2R2-S3, 24.4R2-S1, or 25.2R1-S1, 25.2R2. Don’t leave your network vulnerable—act now! You've got this! By following these steps, you'll not only safeguard your network but also become a security hero! 🛡️