CVE-2026-21920
Published: 15 January 2026
Summary
CVE-2026-21920 is a high-severity Unchecked Return Value (CWE-252) vulnerability in Juniper Junos. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 4.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Threat & Defense at a Glance
Threat & Defense Details
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Crafted DNS request exploits unchecked return value in public-facing DNS service on SRX, directly causing flowd crash for endpoint DoS via application exploitation.
NVD Description
An Unchecked Return Value vulnerability in the DNS module of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). If an SRX Series device configured for DNS processing, receives a specifically formatted…
more
DNS request flowd will crash and restart, which causes a service interruption until the process has recovered. This issue affects Junos OS on SRX Series: * 23.4 versions before 23.4R2-S5, * 24.2 versions before 24.2R2-S1, * 24.4 versions before 24.4R2. This issue does not affect Junos OS versions before 23.4R1.
Deeper analysisAI
CVE-2026-21920 is an Unchecked Return Value vulnerability (CWE-252) in the DNS module of Juniper Networks Junos OS on SRX Series devices. It affects Junos OS versions 23.4 prior to 23.4R2-S5, 24.2 prior to 24.2R2-S1, and 24.4 prior to 24.4R2. The vulnerability does not impact Junos OS versions before 23.4R1. The issue has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), highlighting high availability impact with no confidentiality or integrity effects.
An unauthenticated, network-based attacker can exploit this vulnerability by sending a specifically formatted DNS request to an SRX Series device configured for DNS processing. This triggers the flowd process to crash and restart, causing a Denial-of-Service (DoS) condition and temporary service interruption until the process recovers.
Juniper Networks has published security advisory JSA106020, accessible at https://kb.juniper.net/JSA106020 and https://supportportal.juniper.net/JSA106020, which details the affected versions and recommends mitigation by upgrading to patched releases such as 23.4R2-S5, 24.2R2-S1, or 24.4R2.
Details
- CWE(s)