CVE-2026-21918 Junos OS: SRX and MX Series: When TCP packets occur in a specific sequence flowd crashes

High 8.7 Published 15 Jan 2026 Updated 15 Jan 2026

An unauthenticated attacker can cause a denial of service by sending specific TCP packets that trigger a double free in the flow processing daemon.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-21918?

CVE-2026-21918 is a high-severity memory corruption vulnerability in Juniper Junos, published on 15 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A Double Free vulnerability in the flow processing daemon (flowd) of Juniper Networks Junos OS on SRX and MX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). On all SRX and MX Series platforms, when during TCP session establishment a specific sequence of packets is encountered a double free happens. This causes flowd to crash and the respective FPC to restart.

This issue affects Junos OS on SRX and MX Series:

* all versions before 22.4R3-S7, * 23.2 versions before 23.2R2-S3, * 23.4 versions before 23.4R2-S4, * 24.2 versions before 24.2R2.

Weakness: CWE-415

Which versions are affected by CVE-2026-21918?

It affects 1 product.

Products include Juniper Junos.

How do I fix CVE-2026-21918?

No fix has been published for CVE-2026-21918 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-21918 being exploited?

There is no known exploitation of CVE-2026-21918 in the wild and no public exploit code.

All Juniper Junos vulnerabilities

Sources

Also known as GHSA-9m47-29xf-m969.