High

DoS in Juniper Junos OS SRX flowd NAT64 ICMPv6 handling

IdentifiersCVE-2026-33790CWE-754· Improper Check for Unusual or…

CVE-2026-33790 is a denial-of-service vulnerability in Juniper Networks Junos OS on SRX Series devices. The flaw is in the flow daemon packet-processing path, where the srxpfe process improperly handles unusual or malformed ICMPv6 input during NAT64 translation. A specifically malformed ICMPv6 packet destined to the device can trigger an exceptional condition that causes the srxpfe process to crash and restart. Because the vulnerable condition is reached during NAT64 processing, the issue is limited to SRX devices with NAT64 enabled and does not appear to be triggerable through IPv4 traffic or unrelated IPv6 traffic. Repeated delivery of the malformed packet can repeatedly crash the process and maintain the denial-of-service state.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation causes the srxpfe packet-forwarding process to crash and restart on the affected SRX device. If an attacker continues sending the malformed ICMPv6 traffic, the process can be forced into repeated crash cycles, resulting in sustained denial of service and disruption of packet forwarding and firewall operations handled by the affected processing path. The available information indicates service availability impact rather than code execution, privilege escalation, or data disclosure.

Mitigation

If you can’t patch tonight, do this now.

No workaround is currently available. Risk reduction depends on eliminating exposure conditions where feasible, particularly by disabling or avoiding vulnerable NAT64 deployment on affected versions until upgrades can be completed, and by restricting untrusted IPv6 reachability to the device where operationally possible. The primary corrective action is patching or migration to a fixed supported release.

Remediation

Patch, then assume compromise.

Upgrade affected SRX Series devices to a fixed Junos OS release. Reported fixed versions include 21.2R3-S10, 21.4R3-S12, 22.2R3-S8, 22.4R3-S9, 23.2R2-S6, 23.4R2-S7, 24.2R2-S3, 24.4R2-S3, and 25.2R1-S2 or 25.2R2. Branches identified as end-of-life or end-of-engineering, including 21.3 and 22.1, do not have fixes available and should be migrated to a supported fixed release.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Juniper NetworksJunosoperating_system

Juniper NetworksJunos Osoperating_system

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

7 SOURCESView more in app

zeropath blogNews

Apr 9, 2026

Juniper SRX Series CVE-2026-33790: NAT64 ICMPv6 Denial of Service via srxpfe Crash - ZeroPath Blog | ZeroPath

A remotely exploitable, unauthenticated denial-of-service vulnerability in Juniper SRX Series firewalls running vulnerable Junos OS versions with NAT64 enabled. A malformed ICMPv6 packet can crash the srxpfe packet forwarding engine and sustain an outage through repeated triggering.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity5