Executive brief
A race condition in Juniper Networks Junos OS on SRX Series firewalls can cause network traffic sessions to remain active indefinitely instead of being cleared. Over time, these "zombie" sessions accumulate and exhaust system resources, eventually causing the firewall to stop forwarding traffic or crash. This results in a total loss of network connectivity that requires a manual reboot to restore operations.
Technical details
A race condition (CWE-362) exists in the Packet Forwarding Engine (PFE) of Junos OS on SRX Series devices during the stateful flow removal process. When a flow is being decommissioned, the timeout value—which should be set to 3 seconds—may incorrectly be set to a value exceeding 10,000 seconds. These invalidated sessions accumulate and cannot be cleared manually via standard CLI commands. This resource exhaustion leads to a Denial-of-Service (DoS) condition where the device either stops forwarding packets or experiences a 'flowd' process core dump and subsequent reboot. The vulnerability is reachable via the network without authentication, though the race condition timing is not directly controllable by the attacker.
Affected products
- Juniper Networks Junos OS 24.2 versions before 24.2R2-S3; 24.4 versions before 24.4R2-S1, 24.4R2-S2; 25.2 versions before 25.2R1-S2, 25.2R2
Timeline
- 2026-07-09: advisory: Initial publication of JSA110090 / CVE-2026-57030