CVE-2026-57030: Juniper SRX Race Condition DoS Vulnerability

Technical summary

CVE-2026-57030 is a race condition (CWE-362) in the Junos OS packet forwarding engine (PFE) affecting SRX Series stateful inspection devices. During flow session removal, improper synchronization when setting flow timeouts can result in the timeout value being set to >10,000 seconds instead of the intended 3 seconds. This leads to accumulated invalid sessions visible in 'show security flow session summary' output. The accumulation of uncleared sessions eventually exhausts forwarding resources, triggering either complete forwarding halt or a flowd process crash with automatic device reboot. The vulnerability requires network access but no authentication or user interaction; exploitation is probabilistic due to the race condition's unpredictable nature.

Business impact

Organizations running Juniper SRX firewalls face potential network outages when this vulnerability is triggered. The impact ranges from gradual performance degradation and session table exhaustion to complete loss of firewall forwarding functionality. Affected organizations may experience unplanned downtime requiring manual device recovery or reboot, disrupting all traffic inspection and security policy enforcement. For critical security infrastructure relying on SRX devices for perimeter defense or internal traffic segmentation, this represents a material availability risk.

Affected systems

The vulnerability affects Juniper Junos OS running on SRX Series devices. Specific affected versions include: 24.2 releases before 24.2R2-S3; 24.4 releases before 24.4R2-S1 and 24.4R2-S2; and 25.2 releases before 25.2R1-S2 and 25.2R2. Releases earlier than 24.2R1 are not affected. This covers a broad range of SRX hardware models including the SRX300, SRX320, SRX340, SRX345, SRX380, SRX400, SRX440, SRX1500, SRX1600, SRX2300, SRX4100, SRX4120, SRX4200, SRX4300, SRX4600, SRX4700, SRX5400, SRX5600, and SRX5800.

Exploitability

Exploitation requires only network access and no authentication credentials. However, the CVSS score of 5.9 (MEDIUM) reflects an important constraint: the race condition's timing is outside the attacker's direct control, making reliable exploitation probabilistic rather than deterministic. An attacker would need to send traffic patterns that coincidentally trigger the timeout-setting race window, but given that SRX devices continuously process flows in production environments, opportunities for collision should arise with reasonable frequency under sustained traffic. This is not a trivial one-packet exploit; rather, it represents a DoS vector that becomes increasingly likely with higher traffic volumes or specific flow churn patterns.

Remediation

Juniper has released patched versions addressing this race condition. Organizations should upgrade to: Junos OS 24.2R2-S3 or later for the 24.2 branch; 24.4R2-S1, 24.4R2-S2, or later for the 24.4 branch; or 25.2R1-S2, 25.2R2, or later for the 25.2 branch. Verify exact patch availability against Juniper's security advisory before deployment. Interim mitigations such as flow session monitoring and manual flow clearing may help detect problems early, but complete remediation requires patching. Organizations unable to patch immediately should prioritize SRX devices in high-traffic or critical-path positions for upgrade scheduling.

Patch guidance

Consult Juniper's official security advisory for the exact patched version numbers and download links applicable to your deployment. Patches are available for 24.2, 24.4, and 25.2 branches. Standard Junos OS upgrade procedures apply: schedule maintenance windows, back up configurations, test patches in non-production environments if possible, and monitor device stability post-upgrade. High-availability SRX clusters should coordinate upgrades to maintain redundancy. Given the probabilistic nature of the vulnerability and its potential for unplanned reboot, patching should be prioritized within normal change windows rather than waiting for emergency hotfix cycles.

Detection guidance

Monitor SRX devices for accumulating invalidated sessions using 'show security flow session summary | match invalid'. A rising trend in invalidated sessions without corresponding clearing may indicate exposure to this race condition. Additionally, watch for unexpected flowd process crashes, automatic device reboots, or forwarding halts correlated with high flow churn or unusual traffic patterns. Flow session timeout anomalies (timeouts >10,000 seconds visible via 'show security flow session') are a direct indicator. Correlate SRX logs and syslog output for flowd restarts or core dumps. Organizations should establish baseline flow session counts and alert on anomalous growth.

Why prioritize this

Although rated MEDIUM severity, this vulnerability merits prompt prioritization because it affects critical security infrastructure (SRX firewalls), can cause unplanned downtime, and is triggered by ordinary network traffic patterns without requiring exploitation sophistication. For organizations where SRX devices handle mission-critical traffic inspection, the business impact of an unplanned reboot justifies accelerated patch scheduling. The probabilistic nature of the race condition means that patching is more practical than attempting to avoid triggering it through traffic engineering.

Risk score, explained

The CVSS 3.1 score of 5.9 reflects high attack complexity (AC:H) due to the race condition's unpredictable timing, combined with high availability impact (A:H) and network-based attack vector (AV:N) requiring no authentication. The score appropriately captures that exploitation is feasible but not trivial, and the impact—denial of service causing potential device unavailability—is severe but limited to availability rather than affecting confidentiality or integrity.

Frequently asked questions