CVE-2026-102077
7.5HighPublished 14 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-754
Impact
Remote, unauthenticated attackers can cause a full Denial of Service across the device by sending malformed IPv6 packets that exhaust NAT and session resources. Recovery requires a full device reboot.
Root cause
The Packet Forwarding Engine fails to drop malformed IPv6 packets under source NAT configurations, incorrectly creating sessions and allocating NAT pool resources until exhaustion.
Affected systems
Juniper Networks Junos OS on MX Series with SPC3: all versions prior to 23.2R2-S4, 23.4 versions prior to 23.4R2-S5, and 24.2 versions prior to 24.2R2.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Fix & remediation
Upgrade to Junos OS 23.2R2-S4, 23.4R2-S5, 24.2R2, or later. No workaround is listed; monitor exhaustion using 'show services sessions summary' and 'show services nat pool'.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series with SPC3 allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). On MX Series with SPC3 line-card and source NAT configuration, when a specific malformed IPv6 packet is received, it is not dropped but instead a session is created and NAT resources are allocated. Continued receipt of such packets will eventually lead to session or resource exhaustion, which will impact all traffic through the device. To recover the device needs to be rebooted. To monitor session usage, use the following: show services sessions summary To monitor source NAT resource usage, use the following: show services nat pool This issue affects Junos OS on MX Series with SPC3: * All versions before 23.2R2-S4; * 23.4 versions before 23.4R2-S5; * 24.2 versions before 24.2R2.