CVE-2026-57030 is a race condition vulnerability in the packet forwarding engine of Juniper Networks Junos OS on SRX Series devices. During flow removal, a race condition can cause the flow timeout to be set incorrectly to a very high value (>10,000 seconds) instead of the intended 3 seconds. This leads to an accumulation of invalidated sessions that cannot be cleared manually, causing denial-of-service by stopping forwarding or triggering a flowd core and automatic reboot. The vulnerability affects Junos OS versions 24.2 prior to 24.2R2-S3, 24.4 prior to 24.4R2-S1 and 24.4R2-S2, and 25.2 prior to 25.2R1-S2 and 25.2R2. Releases earlier than 24.2R1 are not affected. A patch is available as this is a cloud-managed service, and Juniper manages remediation server-side.

An unauthenticated network attacker can exploit this race condition to cause denial-of-service on SRX Series devices by causing flow timeouts to be set incorrectly, leading to an accumulation of invalidated sessions. This accumulation cannot be cleared manually and results in forwarding stoppage or a flowd core crash causing automatic reboot. There is no impact on confidentiality or integrity, only availability is affected.

Juniper manages remediation for this cloud-hosted service and has made patches available for the affected versions. Users should ensure their devices are updated to versions 24.2R2-S3 or later, 24.4R2-S2 or later, and 25.2R2 or later to mitigate this vulnerability. Check the official Juniper advisory for the latest patch and update instructions. No additional manual mitigation is required as the vendor handles patching for the cloud service.