CVE-2026-102083: CWE-413 Improper Resource Locking in Juniper Networks Junos OS

This vulnerability (CWE-413) in Juniper Networks Junos OS on SRX Series arises from improper resource locking in the UTM WebFiltering subsystem. Specifically, when the WebFiltering cloud server is unreachable, HTTP traffic load causes category lookup requests to accumulate internally. Under high load and specific timing conditions, an invalid internal state occurs during cleanup of pending lookups, causing the UTM process to crash and restart. This results in a denial-of-service condition until recovery. The vulnerability affects both NGWF and EWF implementations and is present in Junos OS versions 23.2R2 up to but not including 23.2R2-S7.7, 23.4R2 up to but not including 23.4R2-S8.13, 24.2 up to but not including 24.2R2-S5.5, 24.4 up to but not including 24.4R2-S4, 25.2 up to but not including 25.2R2-S1, and version 25.4.

An unauthenticated, network-based attacker can cause a denial-of-service by triggering sustained HTTP traffic when the WebFiltering cloud server is unreachable. This causes the UTM subsystem to crash and restart, resulting in a complete service outage until recovery. There is no impact on confidentiality or integrity, only availability is affected.

A patch is available for the affected Junos OS versions. Users should upgrade to the fixed versions: 23.2R2-S7.7 or later, 23.4R2-S8.13 or later, 24.2R2-S5.5 or later, 24.4R2-S4 or later, 25.2R2-S1 or later, and versions beyond 25.4R1-S3 and 25.4R2. Applying these updates will remediate the vulnerability. No additional mitigation steps are indicated by the vendor advisory.