CVE-2026-0203: Juniper Junos OS ICMP DoS Vulnerability

CVE-2026-0203 Overview

An Improper Handling of Exceptional Conditions vulnerability (CWE-755) in the packet processing functionality of Juniper Networks Junos OS allows an unauthenticated, network-adjacent attacker to cause a Denial of Service (DoS) condition. By sending a specifically malformed ICMP packet with an invalid IP header value, an attacker can cause the Flexible PIC Concentrator (FPC) to crash and restart, disrupting network operations.

The vulnerability is triggered when an ICMPv4 packet with a malformed IP header is received by a vulnerable system. The packet processing code fails to properly handle the exceptional condition presented by the malformed header, resulting in an uncontrolled crash of the FPC component. Notably, this vulnerability only affects ICMPv4 processing—ICMPv6 is not vulnerable to this attack.

Due to the specific nature of the malformed packet, adjacent upstream routers would typically not forward the traffic, which limits the attack surface to network-adjacent scenarios. However, this still presents a significant risk in shared network environments where an attacker has Layer 2 adjacency to the target device.

Critical Impact

Unauthenticated network-adjacent attackers can crash and restart the FPC, causing network service interruption and potential cascading failures in routing infrastructure.

Affected Products

• Juniper Networks Junos OS all versions before 21.2R3-S9
• Juniper Networks Junos OS from 21.4 before 21.4R3-S10
• Juniper Networks Junos OS from 22.2 before 22.2R3-S7
• Juniper Networks Junos OS from 22.3 before 22.3R3-S4
• Juniper Networks Junos OS from 22.4 before 22.4R3-S5
• Juniper Networks Junos OS from 23.2 before 23.2R2-S3
• Juniper Networks Junos OS from 23.4 before 23.4R2-S3
• Juniper Networks Junos OS from 24.2 before 24.2R1-S2 or 24.2R2

Discovery Timeline

• 2026-01-15 - CVE-2026-0203 published to NVD
• 2026-01-16 - Last updated in NVD database

Technical Details for CVE-2026-0203

Vulnerability Analysis

This vulnerability stems from improper exception handling in the Junos OS packet processing pipeline. When the FPC receives an ICMPv4 packet containing a specifically malformed IP header value, the packet processing code encounters an unexpected condition that it cannot gracefully handle. Rather than discarding the malformed packet and continuing operation, the FPC enters an unrecoverable state that forces a restart.

The attack requires network adjacency (Layer 2 access), meaning an attacker must be on the same network segment or have a direct Layer 2 path to the target device. While this limits remote exploitation over the internet, it remains a significant concern in enterprise LAN environments, data center interconnects, and carrier exchange points where multiple organizations may share network infrastructure.

The FPC restart causes temporary loss of packet forwarding capability for the affected line card, which can have cascading effects on routing protocols, established sessions, and dependent services. Repeated exploitation could result in sustained service disruption.

Root Cause

The root cause is classified as CWE-755: Improper Handling of Exceptional Conditions. The Junos OS packet processing code fails to validate or properly handle certain malformed values within the IP header of incoming ICMPv4 packets. When these exceptional values are encountered, the code path leads to an unhandled exception that crashes the FPC process.

Proper input validation should reject or safely handle any malformed packets before they can trigger internal processing errors. The fix likely adds additional boundary checking and exception handling around IP header parsing for ICMP packets.

Attack Vector

The attack vector requires network adjacency (Adjacent Network), meaning the attacker must have Layer 2 connectivity to the target Junos OS device. The attack is executed as follows:

1. The attacker positions themselves on a network segment adjacent to the target Juniper device
2. The attacker crafts a malformed ICMPv4 packet with a specifically invalid IP header value
3. The packet is transmitted to the target device
4. Upon receiving and processing the packet, the FPC crashes
5. The FPC automatically restarts, causing temporary service disruption

The attack requires no authentication or user interaction, and can be executed with low complexity. However, the malformed nature of the packet prevents it from being forwarded by upstream routers, containing the attack to adjacent networks.

Detection Methods for CVE-2026-0203

Indicators of Compromise

• Unexpected FPC crashes and restarts logged in system messages
• Repeated ICMP-related error messages in packet processing logs
• Unusual patterns of malformed ICMPv4 traffic from specific source addresses
• Rapid succession of FPC restart events that may indicate active exploitation

Detection Strategies

• Monitor FPC crash logs for patterns indicating exploitation attempts
• Implement network monitoring to detect anomalous ICMP traffic patterns on adjacent segments
• Configure SNMP traps or syslog alerts for FPC restart events
• Deploy packet capture capabilities on management interfaces to analyze ICMP traffic during incident investigation

Monitoring Recommendations

• Enable enhanced logging for packet processing events on Junos OS devices
• Configure centralized log collection for correlation of FPC crash events across infrastructure
• Implement baseline monitoring for FPC uptime and restart frequency
• Deploy network-based intrusion detection systems capable of inspecting ICMP packet headers for malformation

How to Mitigate CVE-2026-0203

Immediate Actions Required

• Review Juniper Security Advisory JSA104294 for complete vulnerability details
• Inventory all Junos OS devices and identify those running vulnerable versions
• Prioritize patching for devices in shared network environments with untrusted adjacent hosts
• Consider implementing firewall filters to restrict ICMP traffic from untrusted sources where operationally feasible

Patch Information

Juniper Networks has released patches addressing this vulnerability. Organizations should upgrade to the following fixed versions based on their current release train:

• Version 21.2R3-S9 or later for the 21.2 release
• Version 21.4R3-S10 or later for the 21.4 release
• Version 22.2R3-S7 or later for the 22.2 release
• Version 22.3R3-S4 or later for the 22.3 release
• Version 22.4R3-S5 or later for the 22.4 release
• Version 23.2R2-S3 or later for the 23.2 release
• Version 23.4R2-S3 or later for the 23.4 release
• Version 24.2R1-S2 or 24.2R2 or later for the 24.2 release

Consult the Juniper Support Portal for download links and detailed upgrade instructions.

Workarounds

• Implement firewall filters to restrict inbound ICMP traffic from untrusted or unnecessary sources
• Segment network infrastructure to limit Layer 2 adjacency between critical routing devices and untrusted hosts
• Deploy rate limiting for ICMP traffic on interfaces connected to shared network segments
• Consider disabling ICMP echo responses where operationally acceptable until patching is complete

# Example firewall filter to restrict ICMP on Junos OS
# Note: Adjust based on operational requirements
set firewall family inet filter ICMP-PROTECT term ALLOW-TRUSTED from source-address <trusted-networks>
set firewall family inet filter ICMP-PROTECT term ALLOW-TRUSTED from protocol icmp
set firewall family inet filter ICMP-PROTECT term ALLOW-TRUSTED then accept
set firewall family inet filter ICMP-PROTECT term DENY-ICMP from protocol icmp
set firewall family inet filter ICMP-PROTECT term DENY-ICMP then discard
set firewall family inet filter ICMP-PROTECT term ALLOW-ALL then accept