CVE-2026-57021: Juniper Junos SRX Out-of-Bounds Write DoS Vulnerability

Technical summary

CVE-2026-57021 is an out-of-bounds write vulnerability (CWE-787) in the http-gatekeeper process of Juniper Junos OS running on SRX Series platforms. The vulnerability exists in the HTTP request handling logic when remote-access VPN is configured with pre-logon compliance check enabled. A network-based attacker can craft malformed HTTP requests that cause the http-gk process to write data beyond allocated buffer boundaries, resulting in process termination. The crash persists until automatic process restart, during which dependent services—including J-Web, remote VPN access, and firewall authentication—become unavailable. The vulnerability requires no authentication and can be triggered with a single or small number of network requests.

Business impact

For organizations operating SRX Series devices as VPN gateways or perimeter firewalls, this vulnerability creates a denial-of-service vector that could temporarily disable remote access infrastructure. Depending on the criticality of VPN connectivity and J-Web-based management workflows, repeated attacks could degrade operational continuity. The impact is bounded by automatic process restart, meaning full system recovery occurs without manual intervention, but service interruption during restart may affect business operations relying on continuous VPN or firewall management access. Organizations with high-availability VPN requirements should prioritize patching.

Affected systems

Juniper Junos OS on SRX Series is affected across multiple versions: 23.2 (before 23.2R2-S7), 23.4 (before 23.4R2-S8), 24.2 (before 24.2R2-S4), 24.4 (before 24.4R2-S4), 25.2 (before 25.2R2), and 25.4 (before 25.4R1-S1 and 25.4R2). The vulnerability is only exploitable when remote-access VPN with pre-logon compliance check is configured; default SRX configurations without this feature are not affected. Verify your running version and VPN configuration against Juniper's official security advisory.

Exploitability

This vulnerability has a CVSS 3.1 score of 5.3 (Medium severity) with a network attack vector and no authentication requirement. Exploitability is straightforward—an attacker on the network can send crafted requests without authentication or user interaction. The attack does not require knowledge of internal network structure or credentials. However, the vulnerability only manifests if pre-logon compliance check is enabled on a remote-access VPN configuration, which narrows the attack surface to specifically configured deployments. The impact is limited to denial-of-service (process crash), not data exfiltration or privilege escalation. No known public exploit code is available at this time, and the vulnerability is not yet tracked in CISA's Known Exploited Vulnerabilities catalog.

Remediation

Update Junos OS to a patched version: 23.2R2-S7 or later (23.2 track), 23.4R2-S8 or later (23.4 track), 24.2R2-S4 or later (24.2 track), 24.4R2-S4 or later (24.4 track), 25.2R2 or later (25.2 track), or 25.4R1-S1, 25.4R2, or later (25.4 track). If immediate patching is not feasible, consider disabling or limiting remote-access VPN pre-logon compliance check, or restricting network access to VPN gateway interfaces through firewall rules or network segmentation. Verify all patch versions against Juniper's official security bulletin.

Patch guidance

Consult Juniper Networks' official security advisory for CVE-2026-57021 to confirm the exact patch versions for your deployment. Test patches in a non-production environment first, as Junos updates may require configuration validation and potentially a reboot depending on your platform and deployment model. Plan patching during a maintenance window to account for any service restart. Organizations on extended support or legacy versions should check with Juniper for backport availability and support timelines.

Detection guidance

Monitor http-gk process restart events and service unavailability logs on SRX devices, particularly for unexpected crashes of web-management or VPN authentication services. Look for patterns of crash events correlated with unusual incoming HTTP traffic. If your environment supports NetFlow or deep packet inspection, track anomalous HTTP requests targeting the management interface. Check Juniper's advisory for any optional IDS/IPS signatures. Enable HTTP request logging on the SRX if available and review for malformed or oversized HTTP headers.

Why prioritize this

Prioritize this patch for SRX devices that serve as primary VPN gateways or critical authentication touchpoints. The vulnerability's exploitability is low-friction (no authentication needed, network-accessible) and the affected versions span recent and current Junos releases, meaning many organizations are likely vulnerable. Although the impact is bounded to temporary service disruption rather than data breach, repeated attacks could degrade availability SLAs. However, organizations without remote-access VPN configured, or those without pre-logon compliance check enabled, face minimal risk and may deprioritize patching.

Risk score, explained

The CVSS 3.1 score of 5.3 reflects the moderate risk profile: network attack vector and no authentication requirements elevate exploitability, but the impact is limited to availability (process crash with automatic restart) and does not include confidentiality or integrity compromise. The score appropriately balances the ease of triggering the vulnerability against its bounded impact. Real-world risk depends heavily on your network topology, VPN criticality, and whether pre-logon compliance check is actually enabled in your configuration.

Frequently asked questions