CVE-2026-57023: Juniper Junos TCP Proxy DoS Vulnerability – MX and SRX Router Impact

Technical summary

CVE-2026-57023 is an improper input validation vulnerability (CWE-1284) affecting the TCP proxy plugin in Junos OS when operating in conjunction with Advanced Layer 7 services including ALGs, Advanced Anti-Malware, ICAP, or UTM. The vulnerability resides in flow processing daemon (flowd) packet handling logic. A TCP packet containing a malformed TCP header, when processed by an active TCP proxy session, triggers an uncaught exception or invalid state that crashes flowd. Because flowd is critical to packet forwarding, its restart causes a temporary but complete data plane outage. The attack surface is the network path to affected routers; no privileged access or authentication is required to send a malicious packet.

Business impact

For organizations running Juniper MX or SRX routers with TCP proxy enabled, this vulnerability poses significant operational risk. A single malicious packet can render the router unavailable until flowd automatically recovers—a process that may take seconds to minutes depending on system load and configuration. For enterprises using these platforms as core WAN aggregation or security appliances, even brief outages can disrupt critical traffic. This is particularly severe for customers relying on these routers for SD-WAN, firewall, or threat prevention services. The vulnerability requires no exploit sophistication, meaning it can be triggered accidentally or maliciously by any networked attacker, elevating the risk profile.

Affected systems

Juniper Junos OS running on MX Series routers with SPC3 line cards and SRX Series security appliances are vulnerable. Specifically affected models include MX240, MX480, MX960 with SPC3, and SRX1500, SRX1600, SRX2300, SRX300, SRX320, and SRX340. The vulnerability exists in Junos OS versions 23.4 prior to 23.4R2-S7, 24.2 prior to 24.2R2-S4, 24.4 prior to 24.4R2-S3, and 25.2 prior to 25.2R2. Releases before 23.4R1 are unaffected. Only systems with TCP proxy explicitly enabled—typically in deployments leveraging advanced threat prevention, UTM, or ICAP integration—are at risk.

Exploitability

This vulnerability has a CVSS score of 7.5 (HIGH) with a network-based attack vector requiring no authentication or user interaction. Exploitability is high: the attack requires only the ability to send a TCP packet with a malformed header across the network to an affected router. An attacker does not need credentials, advanced knowledge of the target system configuration, or interaction from legitimate users. The barrier to weaponization is low, as TCP packet crafting is a routine task in network security testing. However, the vulnerability requires TCP proxy to be active, which is not a default configuration on all deployments—this reduces the practical attack surface in some environments but not others. The lack of current CISA KEV listing suggests limited active exploitation in the wild at present, but this may change as awareness spreads.

Remediation

Vendors must apply Juniper's patched releases: Junos OS 23.4R2-S7 or later, 24.2R2-S4 or later, 24.4R2-S3 or later, or 25.2R2 or later, depending on the branch currently deployed. Operators should verify their current Junos OS version using 'show version' and cross-reference against the affected version list. Patching should be prioritized for routers exposed to untrusted networks, such as WAN edge or internet-facing appliances. For organizations unable to patch immediately, consider temporarily disabling TCP proxy if operational requirements permit, though this may reduce security functionality for ALG, anti-malware, or UTM services. Implement network-level mitigations such as source-based ingress filtering to limit the origin of TCP packets reaching the router, though this may not be practical for all deployment models.

Patch guidance

Apply the latest patched version from Juniper Networks: for Junos OS 23.4 branch, upgrade to 23.4R2-S7 or later; for 24.2 branch, upgrade to 24.2R2-S4 or later; for 24.4 branch, upgrade to 24.4R2-S3 or later; for 25.2 branch, upgrade to 25.2R2 or later. Verify the applied version with 'show version' after upgrade. No interim configuration workaround fully mitigates the risk without impacting services, so patching is the recommended path. Organizations should schedule maintenance windows to minimize business disruption during OS upgrades on production routers. Test patches in a lab or non-production environment first to ensure compatibility with local configurations and integrated systems.

Detection guidance

Monitor Junos OS syslog and logging for flowd restart events or unexpected process crashes. Anomalous TCP header patterns in packet captures may reveal reconnaissance or exploitation attempts—look for TCP packets with invalid header field combinations, zero-length payloads with unusual flags, or malformed option fields arriving at the router's ingress interfaces. Establish baseline metrics for flowd process stability; a sudden increase in restarts or crashes correlates with potential exploitation. Implement packet-level inspection on network segments that can feed traffic to vulnerable routers to identify malformed TCP frames. Configure alerting on device restarts or high CPU usage during flowd crashes. If TCP proxy is not essential for your deployment, disable it and monitor logs to confirm no legitimate traffic is affected.

Why prioritize this

This vulnerability merits immediate prioritization due to its combination of high CVSS score (7.5), unauthenticated network exploitability, and critical infrastructure impact. MX and SRX routers are often core network components handling mission-critical traffic; denial of service on these platforms directly threatens business continuity. The vulnerability does not require authentication, sophisticated tooling, or user interaction—any attacker with network access can trigger it. Organizations operating these routers with TCP proxy enabled and exposure to untrusted networks should treat this as a critical issue. Even though KEV listing is not yet active, the technical simplicity of exploitation means the risk of active attacks is substantial. Patching should commence immediately for internet-facing or high-traffic appliances, with a goal of completing patching for all vulnerable systems within 30 days.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects a HIGH severity rating driven by network-based attack vector (AV:N), low complexity (AC:L), no authentication requirement (PR:N), no user interaction (UI:N), and high impact to availability (A:H). The scoring correctly captures that an unauthenticated attacker can completely disable the device's flow processing capability from the network. The absence of confidentiality and integrity impact (both None) reflects the denial-of-service nature rather than data breach risk. Contextually, the actual business risk may be higher than the base CVSS suggests: for an organization whose routers are on the perimeter or in security-critical roles, the ability to cause complete traffic outage with a single packet represents existential risk to network availability. Conversely, for organizations with robust failover architectures and TCP proxy disabled, the risk is lower. Use this score as a baseline for prioritization, but adjust according to your specific network topology and the criticality of affected routers.

Frequently asked questions