---
id: CVE-2026-103405
title: >-
  Session Smart Router and Session Smart Conductor: Unsanitized input causes
  HTTP response splitting
summary: "An Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the web server in Juniper Networks Session Smart Router and Session Smart Conductor\_allows an attacker to inject arbit…"
severity: medium
cvss: 5.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-74
vendor: Juniper Networks
product: Session Smart Router
affected:
  - session_smart_router < 7.0.5
  - session_smart_router >= 7.1.0 < 7.1.7
  - session_smart_router >= 7.2.0 < 7.2.3
  - session_smart_conductor < 7.0.5
  - session_smart_conductor >= 7.1.0 < 7.1.7
  - session_smart_conductor >= 7.2.0 < 7.2.3
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T16:35:39.369Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-103405'
references:
  - url: 'https://supportportal.juniper.net/JSA112183'
tags:
  - cve.org
ingestedAt: '2026-10-28T17:14:44.479Z'
---

## Overview

An Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the web server in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker to inject arbitrary HTTP headers via unsanitized request body parameters.

## Affected

- `session_smart_router < 7.0.5`
- `session_smart_router >= 7.1.0 < 7.1.7`
- `session_smart_router >= 7.2.0 < 7.2.3`
- `session_smart_conductor < 7.0.5`
- `session_smart_conductor >= 7.1.0 < 7.1.7`
- `session_smart_conductor >= 7.2.0 < 7.2.3`

## Remediation

The following software releases of Session Smart Router and Session Smart Conductor have been updated to resolve these specific issues:
  *  7.0.5 

and all subsequent releases;
  *  7.1.7 

and all subsequent releases;
  *  7.2.3 and all subsequent releases.

### Workarounds

There are no known workarounds for this issue.