CVE-2026-21914: Juniper Junos OS GTP Plugin DoS Vulnerability

CVE-2026-21914 Overview

An Improper Locking vulnerability (CWE-667) in the GTP plugin of Juniper Networks Junos OS on SRX Series firewalls allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS) condition. When an SRX Series device receives a specifically malformed GPRS Tunnelling Protocol (GTP) Modify Bearer Request message, a lock is acquired and never released. This results in other threads not being able to acquire a lock themselves, causing a watchdog timeout that leads to FPC crash and restart.

Critical Impact

This vulnerability causes complete traffic outage on affected SRX Series devices until automatic recovery completes. The attack is unauthenticated and network-accessible, making it particularly dangerous for internet-facing deployments.

Affected Products

• Juniper Networks Junos OS on SRX Series - all versions before 22.4R3-S8
• Juniper Networks Junos OS on SRX Series - 23.2 versions before 23.2R2-S5
• Juniper Networks Junos OS on SRX Series - 23.4 versions before 23.4R2-S6
• Juniper Networks Junos OS on SRX Series - 24.2 versions before 24.2R2-S3
• Juniper Networks Junos OS on SRX Series - 24.4 versions before 24.4R2-S2
• Juniper Networks Junos OS on SRX Series - 25.2 versions before 25.2R1-S1, 25.2R2

Discovery Timeline

• 2026-01-15 - CVE-2026-21914 published to NVD
• 2026-01-16 - Last updated in NVD database

Technical Details for CVE-2026-21914

Vulnerability Analysis

This vulnerability is classified as an Improper Locking issue (CWE-667), which occurs when a resource that should be protected by a lock mechanism is improperly managed, leading to resource contention issues. In this case, the GTP plugin in Junos OS fails to release a lock after processing a malformed GTP Modify Bearer Request message.

The GTP protocol is used in mobile networks for tunneling user data and control signaling between network nodes. The Modify Bearer Request message is part of the GTPv2-C (GTP Control Plane version 2) protocol used for session management in 4G/LTE and 5G networks. When the SRX Series firewall's GTP inspection plugin encounters a specifically crafted malformed message, the lock acquisition succeeds but the code path that handles the malformed packet fails to execute the corresponding unlock operation.

Root Cause

The root cause stems from improper error handling in the GTP plugin's message parsing logic. When processing a malformed GTP Modify Bearer Request, the lock is acquired at the beginning of the processing routine. However, due to missing or improper error handling for the malformed message case, the function exits without releasing the lock. This creates a deadlock condition where subsequent threads attempting to acquire the same lock are blocked indefinitely, eventually triggering the system's watchdog timer and forcing an FPC (Flexible PIC Concentrator) restart.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker with network access to the SRX Series device can send malformed GTP packets to trigger the vulnerability. The attack characteristics include:

• Network Accessibility: The attack can be launched remotely over the network
• No Authentication Required: The attacker does not need any credentials or prior access
• No User Interaction: The attack is fully automated without requiring any user action
• Automatic Recovery: While the device does recover automatically, the outage persists during the restart cycle

The vulnerability specifically targets environments where SRX Series firewalls are configured to inspect GTP traffic, typically in mobile carrier networks or enterprise environments processing mobile data traffic.

Detection Methods for CVE-2026-21914

Indicators of Compromise

• Unexpected FPC crashes and restarts on SRX Series devices with GTP inspection enabled
• Watchdog timeout messages in system logs preceding FPC failures
• Elevated counts of malformed or dropped GTP Modify Bearer Request messages
• Complete traffic outages on affected SRX interfaces without apparent external cause

Detection Strategies

• Monitor Junos OS system logs for watchdog timeout events and FPC crash indicators
• Implement network flow analysis to detect anomalous GTP Modify Bearer Request patterns
• Configure SNMP traps for FPC health status changes on SRX Series devices
• Deploy network sensors to identify malformed GTP-C protocol messages targeting SRX appliances

Monitoring Recommendations

• Enable detailed logging for the GTP plugin and monitor for parsing errors or exceptions
• Establish baseline metrics for FPC stability and alert on deviation patterns
• Implement real-time monitoring of SRX device availability and traffic throughput
• Review firewall logs for repeated GTP message anomalies from specific source addresses

How to Mitigate CVE-2026-21914

Immediate Actions Required

• Upgrade to a fixed Junos OS version appropriate for your release train immediately
• If immediate patching is not possible, consider disabling GTP inspection temporarily where operationally feasible
• Implement network access controls to limit which sources can send GTP traffic to SRX devices
• Enable enhanced logging and monitoring on affected systems to detect exploitation attempts

Patch Information

Juniper Networks has released patches addressing this vulnerability. Organizations should upgrade to the following fixed versions based on their current release train:

For complete patch details and download information, refer to the Juniper Security Advisory JSA106015.

Workarounds

• Disable GTP inspection on SRX Series devices if this functionality is not operationally required
• Implement upstream filtering to drop malformed GTP packets before they reach SRX devices
• Deploy rate limiting on GTP traffic to reduce the impact of potential exploitation attempts
• Consider placing affected SRX devices behind additional network security layers that can filter GTP traffic

# Example: Disable GTP ALG if not required (consult Juniper documentation for your environment)
set security alg gtp disable
commit