{"id":"CVE-2026-101955","state":"PUBLISHED","title":"Junos OS: SRX Series: Malformed DNS packet causes service disruption when UTM Anti-Spam SBL is used","description":"A Stack-based Buffer Overflow vulnerability in the UTM Anti-Spam SBL of Juniper Networks Junos OS on SRX series allows an unauthenticated remote attacker to cause arbitrary code execution or a denial of service via a injected malformed DNS packet when Anti-Spam SBL inspection is enabled.","publishedAt":"2026-10-14T16:28:41.014Z","updatedAt":"2026-10-16T14:18:52.564Z","severity":{"score":9.2,"label":"Critical","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L","source":"juniper"},"assigner":"juniper","products":["Juniper Networks Junos OS"],"affected":[{"vendor":"Juniper Networks","product":"Junos OS","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"23.2R2-S7.7","versionType":"custom"},{"version":"23.4","status":"affected","lessThan":"23.4R2-S8.13","versionType":"custom"},{"version":"24.2","status":"affected","lessThan":"24.2R2-S5.5","versionType":"custom"},{"version":"24.4","status":"affected","lessThan":"24.4R2-S5","versionType":"custom"},{"version":"25.2","status":"affected","lessThan":"25.2R2-S2","versionType":"custom"},{"version":"25.4","status":"affected","lessThan":"25.4R1-S3","versionType":"custom"},{"version":"26.2","status":"affected","lessThan":"26.2R1-S2","versionType":"custom"}]}],"references":["https://supportportal.juniper.net/JSA112186"],"weaknesses":["CWE-121"],"ingestedAt":"2026-10-29T20:10:13.529Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/101xxx/CVE-2026-101955.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-101955","state":"PUBLISHED","datePublished":"2026-10-14T16:28:41.014Z","dateUpdated":"2026-10-16T14:18:52.564Z","assignerShortName":"juniper","assignerOrgId":"8cbe9d5a-a066-4c94-8978-4b15efeae968","dateReserved":"2026-09-28T16:28:35.624Z"},"containers":{"cna":{"title":"Junos OS: SRX Series: Malformed DNS packet causes service disruption when UTM Anti-Spam SBL is used","descriptions":[{"lang":"en","value":"A Stack-based Buffer Overflow vulnerability in the UTM Anti-Spam SBL of Juniper Networks Junos OS on SRX series allows an unauthenticated remote attacker to cause arbitrary code execution or a denial of service via a injected malformed DNS packet when Anti-Spam SBL inspection is enabled."}],"affected":[{"vendor":"Juniper Networks","product":"Junos OS","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"23.2R2-S7.7","versionType":"custom"},{"version":"23.4","status":"affected","lessThan":"23.4R2-S8.13","versionType":"custom"},{"version":"24.2","status":"affected","lessThan":"24.2R2-S5.5","versionType":"custom"},{"version":"24.4","status":"affected","lessThan":"24.4R2-S5","versionType":"custom"},{"version":"25.2","status":"affected","lessThan":"25.2R2-S2","versionType":"custom"},{"version":"25.4","status":"affected","lessThan":"25.4R1-S3","versionType":"custom"},{"version":"26.2","status":"affected","lessThan":"26.2R1-S2","versionType":"custom"}]}],"references":[{"url":"https://supportportal.juniper.net/JSA112186","tags":["vendor-advisory"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]},{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","baseScore":9.2,"baseSeverity":"CRITICAL","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-121","description":"CWE-121 Stack-based Buffer Overflow","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"juniper","orgId":"8cbe9d5a-a066-4c94-8978-4b15efeae968","dateUpdated":"2026-10-14T16:28:41.014Z"},"configurations":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<tt>[ security utm default-configuration anti-spam type sbl ]</tt>"}],"value":"[ security utm default-configuration anti-spam type sbl ]"}],"datePublic":"2026-10-14T16:00:00.000Z","exploits":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Juniper SIRT is not aware of any malicious exploitation of this vulnerability."}],"value":"Juniper SIRT is not aware of any malicious exploitation of this vulnerability."}],"solutions":[{"lang":"en","supportingMedia":[{"base64":true,"type":"text/html","value":"The following software releases have been updated to resolve this specific issue:<br>\n<br>\nJunos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1, and all subsequent releases.<br><br><b>Note:</b> For Junos OS releases 23.2, 23.4, and 24.2, specific respins have been referenced. Previously published versions of these releases have been rebuilt to resolve the security vulnerabilities identified in this advisory."}],"value":"The following software releases have been updated to resolve this specific issue:\n\n\n\nJunos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1, and all subsequent releases.\n\nNote: For Junos OS releases 23.2, 23.4, and 24.2, specific respins have been referenced. Previously published versions of these releases have been rebuilt to resolve the security vulnerabilities identified in this advisory."}],"source":{"advisory":"JSA112186","defect":["1953149"],"discovery":"INTERNAL"},"workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"There are no known workarounds for this issue."}],"value":"There are no known workarounds for this issue."}],"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-101955","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-16T03:56:35.048614Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-16T14:18:52.564Z"}}]}}}