CVE-2026-57021

Junos OS: SRX Series: If VPN compliance-check is configured an attacker can cause http-gk process crash

MEDIUM

5.3

CVSS Score

Published: July 9, 2026 at 09:05 PM UTC

Updated: October 25, 2026 at 03:10 PM UTC

1 product affected across 1 vendorJunos· also runs on 19 platforms

Using Junos OS by Juniper Networks?

Get instant alerts when new vulnerabilities affect Junos OS - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.3

Exploit prediction

EPSS 0.5%

SSVC

No known exploit

Description

An Out-of-bounds Write vulnerability in the http-gatekeeper (http-gk) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). If an SRX Series device is configured for remote-access VPN with pre-logon compliance check, a network-based attacker sending specifically formatted requests can trigger an out of bounds write leading to an http-gk process crash. This crash leads to unavailability of all services depending on the [ system services web-management ] configuration (like J-Web, remote access VPN and firewall authentication) until the process automatically restarts. This issue affects Junos OS on SRX Series: * 23.2 versions before 23.2R2-S7, * 23.4 versions before 23.4R2-S8, * 24.2 versions before 24.2R2-S4, * 24.4 versions before 24.4R2-S4, * 25.2 versions before 25.2R2, * 25.4 versions before 25.4R1-S1, 25.4R2.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Junos · Juniper Networks

95%

Affected range stops below 23.2R2-S7, so it looks safe — our inference, not a vendor statement

Affected range stops below 23.4R2-S8, so it looks safe — our inference, not a vendor statement

Affected range stops below 24.2R2-S4, so it looks safe — our inference, not a vendor statement

Affected range stops below 24.4R2-S4, so it looks safe — our inference, not a vendor statement

Affected range stops below 25.2R2, so it looks safe — our inference, not a vendor statement

Affected range stops below 25.4R1-S1, 25.4R2, so it looks safe — our inference, not a vendor statement

juniper-srx1500 (environment) · juniper-srx1600 (environment) · juniper-srx2300 (environment) · juniper-srx300 (environment) · juniper-srx320 (environment) · juniper-srx340 (environment) · juniper-srx345 (environment) · juniper-srx380 (environment) · juniper-srx400 (environment) · juniper-srx4100 (environment) · juniper-srx4120 (environment) · juniper-srx4200 (environment) · juniper-srx4300 (environment) · juniper-srx440 (environment) · juniper-srx4600 (environment) · juniper-srx4700 (environment) · juniper-srx5400 (environment) · juniper-srx5600 (environment) · juniper-srx5800 (environment)