CVE-2026-102086: CWE-476 NULL Pointer Dereference in Juniper Networks Junos OS

This vulnerability (CWE-476) in Juniper Networks Junos OS SRX Series occurs due to improper handling of asynchronous logging tasks when multiple DNS queries are processed in a single flow session. Specifically, when one query matches a Security Intelligence feed and another is analyzed for DNS Domain Generation Algorithm, the DNS plugin encounters a NULL pointer dereference leading to an FPC crash. The timing conditions for exploitation are not directly controllable by an attacker. Affected versions include all Junos OS releases before 23.2R2-S7.7, versions from 23.4 up to but not including 23.4R2-S8.13, from 24.2 up to 24.2R2-S5.5, from 24.4 up to 24.4R2-S4, from 25.2 up to 25.2R2-S1, and from 25.4 up to 25.4R1-S2.

An unauthenticated, network-based attacker can cause a complete Denial-of-Service (DoS) on affected Junos OS SRX Series devices by triggering a crash in the forwarding plane card (FPC). There is no impact on confidentiality or integrity, but availability is severely affected due to the device crash.

A fix is available in the following Junos OS versions: 23.2R2-S7.7 and later, 23.4R2-S8.13 and later, 24.2R2-S5.5 and later, 24.4R2-S4 and later, 25.2R2-S1 and later, and 25.4R1-S2 and later. Users should upgrade to these fixed versions to remediate the vulnerability. No additional mitigation steps are indicated.