This vulnerability (CVE-2026-57023) in Juniper Networks Junos OS arises from improper validation of input quantity in the TCP proxy plugin used on MX Series with SPC3 and SRX Series devices. When TCP proxy is active to support ALGs, Advanced Anti-Malware, ICAP, or UTM, a TCP packet with a specifically malformed TCP header can cause the flow processing daemon (flowd) to crash and restart. This results in a complete denial of service until the system recovers automatically. The affected versions are 23.4 prior to 23.4R2-S7, 24.2 prior to 24.2R2-S4, 24.4 prior to 24.4R2-S3, and 25.2 prior to 25.2R2. Versions before 23.4R1 are not vulnerable. The vulnerability has a CVSS 3.1 base score of 7.5 (high severity) with network attack vector, low attack complexity, no privileges or user interaction required, and impacts availability only. A patch is available, and Juniper manages remediation for this cloud-hosted service.

An unauthenticated, network-based attacker can cause the flow processing daemon (flowd) to crash and restart by sending a malformed TCP packet when TCP proxy is engaged. This leads to a complete denial of service (DoS) causing service outage until automatic recovery. There is no impact on confidentiality or integrity, only availability is affected.

A patch is available for this vulnerability. Juniper Networks manages remediation for this cloud-hosted service, so customers should ensure they are running fixed versions: 23.4R2-S7 or later, 24.2R2-S4 or later, 24.4R2-S3 or later, or 25.2R2 or later. Check the vendor advisory for the latest remediation guidance and apply updates accordingly.