CVE-2026-21920
CVE-2026-21920 is a high-severity vulnerability in Juniper Junos with a CVSS 3.x base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-252.
Key facts
- Severity: High (CVSS 3.x base score 7.5)
- CVSS v4: 8.7
- EPSS exploit prediction: 0% (35th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2026-2685
- Weakness: CWE-252
- Affected product: Juniper Junos
- Published:
- Last modified:
Description
An Unchecked Return Value vulnerability in the DNS module of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). If an SRX Series device configured for DNS processing, receives a specifically formatted DNS request flowd will crash and restart, which causes a service interruption until the process has recovered. This issue affects Junos OS on SRX Series: * 23.4 versions before 23.4R2-S5, * 24.2 versions before 24.2R2-S1, * 24.4 versions before 24.4R2. This issue does not affect Junos OS versions before 23.4R1.
Frequently asked questions
- What is CVE-2026-21920?
- An Unchecked Return Value vulnerability in the DNS module of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). If an SRX Series device configured for DNS processing, receives a specifically formatted DNS request flowd will crash and restart, which causes a service interruption until the process has recovered. This issue affects Junos OS on SRX Series: * 23.4 versions before 23.4R2-S5, * 24.2 versions before 24.2R2-S1, * 24.4 versions before 24.4R2. This issue does not affect Junos OS versions before 23.4R1.
- How severe is CVE-2026-21920?
- CVE-2026-21920 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
- Is CVE-2026-21920 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (35th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2026-21920?
- CVE-2026-21920 primarily affects Juniper Junos. In total, 18 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2026-21920?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- Does CVE-2026-21920 have an EU (EUVD) identifier?
- Yes. CVE-2026-21920 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-2685.
- When was CVE-2026-21920 published?
- CVE-2026-21920 was published on 2026-01-15 and last updated on 2026-06-17.
References
Affected products (18)
- cpe:2.3:o:juniper:junos:23.4:-:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:23.4:r1:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:23.4:r1-s1:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:23.4:r1-s2:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:23.4:r2:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:23.4:r2-s1:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:23.4:r2-s2:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:23.4:r2-s3:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:23.4:r2-s4:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:24.2:-:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:24.2:r1:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:24.2:r1-s1:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:24.2:r1-s2:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:24.2:r2:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:24.4:-:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:24.4:r1:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:24.4:r1-s2:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:24.4:r1-s3:*:*:*:*:*:*
More vulnerabilities in Juniper Junos
- CVE-2021-0248 — Critical (CVSS 10.0): This issue is not applicable to NFX NextGen Software. On NFX Series devices the use of Hard-coded Credentials in…
- CVE-2021-0211 — Critical (CVSS 10.0): An improper check for unusual or exceptional conditions in Juniper Networks Junos OS and Junos OS Evolved Routing…
- CVE-2020-1614 — Critical (CVSS 10.0): A Use of Hard-coded Credentials vulnerability exists in the NFX250 Series for the vSRX Virtual Network Function (VNF)…
- CVE-2017-2343 — Critical (CVSS 10.0): The Integrated User Firewall (UserFW) feature was introduced in Junos OS version 12.1X47-D10 on the Juniper SRX Series…
- CVE-2013-4685 — Critical (CVSS 10.0): Buffer overflow in flowd in Juniper Junos 10.4 before 10.4S14, 11.4 before 11.4R7, 12.1 before 12.1R6, and 12.1X44…
- CVE-2017-2349 — Critical (CVSS 9.9): A command injection vulnerability in the IDP feature of Juniper Networks Junos OS on SRX series devices potentially…
All CVEs affecting Juniper Junos →
Other CWE-252 vulnerabilities
- CVE-2025-66565 — Critical (CVSS 9.8): Fiber Utils is a collection of common functions created for Fiber. In versions 2.0.0-rc.3 and below, when the system's…
- CVE-2021-38171 — Critical (CVSS 9.8): adts_decode_extradata in libavformat/adtsenc.c in FFmpeg 4.4 does not check the init_get_bits return value, which is a…
- CVE-2021-26955 — Critical (CVSS 9.8): An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because…
- CVE-1999-0199 — Critical (CVSS 9.8): manual/search.texi in the GNU C Library (aka glibc) before 2.2 lacks a statement about the unspecified tdelete return…
- CVE-2019-15900 — Critical (CVSS 9.8): An issue was discovered in slicer69 doas before 6.2 on certain platforms other than OpenBSD. On platforms without…
- CVE-2010-0211 — Critical (CVSS 9.8): The slap_modrdn2mods function in modrdn.c in OpenLDAP 2.4.22 does not check the return value of a call to the…