CVE-2026-21917 Junos OS: SRX Series: Specifically malformed SSL packet causes FPC crash

High 8.7 Published 15 Jan 2026 Updated 15 Jan 2026

An unauthenticated attacker can crash the firewall's FPC by sending a malformed SSL packet if UTM Web-Filtering is enabled.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-21917?

CVE-2026-21917 is a high-severity denial of service vulnerability in Juniper Junos, published on 15 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An Improper Validation of Syntactic Correctness of Input vulnerability in the Web-Filtering module of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).

If an SRX device configured for UTM Web-Filtering receives a specifically malformed SSL packet, this will cause an FPC crash and restart. This issue affects Junos OS on SRX Series:

* 23.2 versions from 23.2R2-S2 before 23.2R2-S5, * 23.4 versions from 23.4R2-S1 before 23.4R2-S5, * 24.2 versions before 24.2R2-S2, * 24.4 versions before 24.4R1-S3, 24.4R2.

Earlier versions of Junos are also affected, but no fix is available.

Weakness: CWE-1286

Which versions are affected by CVE-2026-21917?

It affects 1 product.

Products include Juniper Junos.

How do I fix CVE-2026-21917?

No fix has been published for CVE-2026-21917 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-21917 being exploited?

There is no known exploitation of CVE-2026-21917 in the wild and no public exploit code.

All Juniper Junos vulnerabilities

Sources

Also known as GHSA-hq5p-jr85-6779.