CVE-2026-21920CWE-252

Junos OS: SRX Series: If a specific request is processed by the DNS subsystem flowd will crash

High · published January 15, 2026

CVSS v4.0
8.7
EPSS
0%
Percentile
40.4
In the wild
Unconfirmed
What it is

🚨 A single malformed DNS request can bring down your SRX Series device! An unauthenticated attacker can exploit this unchecked return value vulnerability in Juniper Networks' Junos OS, leading to service interruptions. ⚠️ Think of it like a restaurant that can't handle a special dish request—one incorrectly prepared order causes the whole kitchen to shut down until it recovers. That's exactly what's happening here, as the DNS module crashes when faced with a specific request. 🍽️ If an attacker sends that cleverly crafted DNS request, the flowd process crashes, causing a denial-of-service condition that disrupts all DNS operations. Imagine users being unable to access critical services while your system tries to recover—it’s a recipe for frustration and downtime! 🔥

Put simply

Think of it like a restaurant that can't handle a special dish request—one incorrectly prepared order causes the whole kitchen to shut down until it recovers. That's exactly what's happening here, as the DNS module crashes when faced with a specific request. 🍽️ This vulnerability in the DNS module of Junos OS on SRX Series devices allows attackers to crash the flowd process by sending a specifically formatted DNS request, which is not checked for a proper return value. This results in an unnecessary restart of the service, leading to brief outages.

What to do

If an attacker sends that cleverly crafted DNS request, the flowd process crashes, causing a denial-of-service condition that disrupts all DNS operations. Imagine users being unable to access critical services while your system tries to recover—it’s a recipe for frustration and downtime! 🔥 To protect your systems, patch your devices to at least Junos OS 23.4R2-S5, 24.2R2-S1, or 24.4R2 if you're running older versions. Ensure that your configuration does not permit unauthorized DNS requests to minimize risk. 🛡️ You've got this! By staying proactive and following these steps, you'll keep your systems running smoothly and securely. 💪✨

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/RE:M
EPSS
0.00480 · 40.4th percentile
Weakness
CWE-252 · Unchecked Return Value
Published
2026-01-15T20:28Z
EPSS history
Timeline
  • 15 JAN 20:28Z
    Junos OS: SRX Series: If a specific request is processed by the DNS subsystem flowd will crash
    cvelistv5