CVE-2026-21906 Denial of service in Junos OS
An unauthenticated attacker can crash the packet forwarding engine on Juniper SRX devices by sending a specific ICMP packet when GRE performance acceleration is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-21906?
CVE-2026-21906 is a high-severity denial of service vulnerability in Juniper Junos, published on 15 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An Improper Handling of Exceptional Conditions vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on SRX Series allows an unauthenticated network-based attacker sending a specific ICMP packet through a GRE tunnel to cause the PFE to crash and restart.
When PowerMode IPsec (PMI) and GRE performance acceleration are enabled and the device receives a specific ICMP packet, a crash occurs in the SRX PFE, resulting in traffic loss. PMI is enabled by default, and GRE performance acceleration can be enabled by running the configuration command shown below. PMI is a mode of operation that provides IPsec performance improvements using Vector Packet Processing.
Note that PMI with GRE performance acceleration is only supported on specific SRX platforms. This issue affects Junos OS on the SRX Series:
* all versions before 21.4R3-S12, * from 22.4 before 22.4R3-S8, * from 23.2 before 23.2R2-S5, * from 23.4 before 23.4R2-S5, * from 24.2 before 24.2R2-S3, * from 24.4 before 24.4R2-S1, * from 25.2 before 25.2R1-S1, 25.2R2.
Weakness: CWE-755
Which versions are affected by CVE-2026-21906?
It affects 1 product.
Products include Juniper Junos.
How do I fix CVE-2026-21906?
No fix has been published for CVE-2026-21906 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-21906 being exploited?
There is no known exploitation of CVE-2026-21906 in the wild and no public exploit code.
Other vulnerabilities in Juniper Junos
- CVE-2023-36845 Juniper Junos OS EX Series and SRX Series PHP External Variable Modification
- CVE-2020-1631 Juniper Junos OS Path Traversal
- CVE-2025-21590 Juniper Junos OS Improper Isolation or Compartmentalization
- CVE-2023-36851 Juniper Junos OS SRX Series Missing Authentication for Critical Function
- CVE-2023-36844 Juniper Junos OS EX Series PHP External Variable Modification
Sources
Also known as GHSA-942f-w2gm-p948.