CVE-2023-36831

Junos OS: SRX Series: jbuf memory leak when SSL Proxy and UTM Web-Filtering is applied

HIGH

7.5

CVSS Score

Published: July 14, 2023 at 02:56 PM UTC

Updated: June 17, 2026 at 06:07 AM UTC

31 products affected across 2 vendorsJunosSRX5600SRX5800

Using Junos OS by Juniper Networks?

Get instant alerts when new vulnerabilities affect Junos OS - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.5

Exploit prediction

EPSS 0.6%

SSVC

No known exploit

Description

An Improper Check or Handling of Exceptional Conditions vulnerability in the UTM (Unified Threat Management) Web-Filtering feature of Juniper Networks Junos OS on SRX Series causes a jbuf memory leak to occur when accessing certain websites, eventually leading to a Denial of Service (DoS) condition. Service restoration is only possible by rebooting the system. The jbuf memory leak only occurs in SSL Proxy and UTM Web-Filtering configurations. Other products, platforms, and configurations are not affected by this vulnerability. This issue affects Juniper Networks Junos OS on SRX Series: 22.2 versions prior to 22.2R3; 22.3 versions prior to 22.3R2-S1, 22.3R3; 22.4 versions prior to 22.4R1-S2, 22.4R2. This issue does not affect Juniper Networks Junos OS versions prior to 22.2R2.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Junos · Juniper Networks

95%

v < 22.2R222.2 ≤ v < 22.2R322.3 ≤ v < 22.3R2-S122.3 ≤ v < 22.3R2-S1, 22.3R322.3 ≤ v < 22.3R322.4 ≤ v < 22.4R1-S222.4 ≤ v < 22.4R1-S2, 22.4R222.4 ≤ v < 22.4R222.2 22.2 r1 22.2 r1-s1 22.2 r1-s2 22.2 r2 22.2 r2-s1 22.2 r2-s2 22.3 22.3 r1 22.3 r1-s1 22.3 r1-s2 22.3 r2 22.4 22.4 r1 22.4 r1-s1

Vendor states this is fixed in 22.2R2 (unaffected)

Affected range stops below 22.2R3, so it looks safe — our inference, not a vendor statement

Affected range stops below 22.3R2-S1, so it looks safe — our inference, not a vendor statement

Affected range stops below 22.3R2-S1, 22.3R3, so it looks safe — our inference, not a vendor statement

Affected range stops below 22.3R3, so it looks safe — our inference, not a vendor statement

Affected range stops below 22.4R1-S2, so it looks safe — our inference, not a vendor statement

Affected range stops below 22.4R1-S2, 22.4R2, so it looks safe — our inference, not a vendor statement

Affected range stops below 22.4R2, so it looks safe — our inference, not a vendor statement

juniper-csrx (environment) · juniper-srx100 (environment) · juniper-srx110 (environment) · juniper-srx1400 (environment) · juniper-srx1500 (environment) · juniper-srx210 (environment) · juniper-srx220 (environment) · juniper-srx240 (environment) · juniper-srx240h2 (environment) · juniper-srx240m (environment) · juniper-srx300 (environment) · juniper-srx320 (environment) · juniper-srx340 (environment) · juniper-srx3400 (environment) · juniper-srx345 (environment) · juniper-srx3600 (environment) · juniper-srx380 (environment) · juniper-srx4000 (environment) · juniper-srx4100 (environment) · juniper-srx4200 (environment) · juniper-srx4600 (environment) · juniper-srx5000 (environment) · juniper-srx5400 (environment) · juniper-srx550 (environment) · juniper-srx550-hm (environment) · juniper-srx550m (environment) · juniper-srx5600 (environment) · juniper-srx5800 (environment) · juniper-srx650 (environment) · juniper-vsrx (environment)

Csrx · Juniperdevice

80%

All versions

SRX100 · Juniperdevice

80%

All versions

SRX110 · Juniperdevice

80%

All versions

SRX1400 · Juniperdevice

80%

All versions