---
id: CVE-2026-101938
title: >-
  An Integer Underflow (Wrap or Wraparound) vulnerability in the srxpfe of
  Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an
  adjacent unauthenticated attacker to cause a forwarding-plane denial of
  service via an IC…
summary: >-
  An Integer Underflow (Wrap or Wraparound) vulnerability in the srxpfe of
  Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an
  adjacent unauthenticated attacker to cause a forwarding-plane denial of
  service via an IC…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-191
vendor: Juniper Networks
product: Junos OS
affected:
  - junos_os < 23.2R2-S7.7
  - junos_os >= 23.4 < 23.4R2-S8.13
  - junos_os >= 24.2 < 24.2R2-S5.5
  - junos_os >= 24.4 < 24.4R2-S5
  - junos_os >= 25.2 < 25.2R2-S2
  - junos_os >= 25.4 < 25.4R1-S3
  - junos_os >= 26.2 < 26.2R1-S2
  - junos_os_evolved < 23.2R2-S7.7-EVO
  - junos_os_evolved >= 23.4 < 23.4R2-S8.11-EVO
  - junos_os_evolved >= 24.2 < 24.2R2-S5.6-EVO
  - junos_os_evolved >= 24.4 < 24.4R2-S5-EVO
  - junos_os_evolved >= 25.2 < 25.2R2-S2-EVO
  - junos_os_evolved >= 25.4 < 25.4R1-S3-EVO
  - junos_os_evolved >= 26.2 < 26.2R1-S2-EVO
  - junos_os_evolved 23.4X100
  - junos_os_evolved >= 25.2X100 < 25.2X100-D35-EVO
  - junos_os_evolved >= 25.4X300 < 25.4X300-D40-EVO
published: '2026-10-14'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T16:23:06.250'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-101938'
references:
  - url: 'https://supportportal.juniper.net/JSA112186'
    label: sirt@juniper.net
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-14T20:15:26.294710Z'
ingestedAt: '2026-10-14T17:44:53.627Z'
epss: 0.00245
epssPercentile: 0.15592
---

## Overview

An Integer Underflow (Wrap or Wraparound) vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an adjacent unauthenticated attacker to cause a forwarding-plane denial of service via an ICMP message associated with an SVR carrier session.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.