An out-of-bounds write vulnerability (CWE-787) exists in the http-gatekeeper (http-gk) component of Juniper Networks Junos OS on SRX Series devices. When remote-access VPN with pre-logon compliance check is enabled, an unauthenticated network attacker can send specially crafted requests that cause the http-gk process to crash. This crash leads to denial-of-service by making dependent services like J-Web, remote access VPN, and firewall authentication unavailable until the process automatically restarts. The affected versions include 23.2 prior to 23.2R2-S7, 23.4 prior to 23.4R2-S8, 24.2 prior to 24.2R2-S4, 24.4 prior to 24.4R2-S4, 25.2 prior to 25.2R2, and 25.4 prior to 25.4R1-S1 and 25.4R2.

The vulnerability allows an unauthenticated, network-based attacker to cause a denial-of-service by crashing the http-gk process on affected Junos OS SRX Series devices. This results in temporary unavailability of critical services such as J-Web, remote access VPN, and firewall authentication until the process restarts automatically. There is no impact on confidentiality or integrity according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary fix is stated in the provided data. Until a patch is available, consider disabling remote-access VPN pre-logon compliance check if feasible to reduce exposure. Monitor vendor advisories for updates on patches or mitigations.