CVE-2021-0261

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, Dynamic-VPN (DVPN), Firewall Authentication Pass-Through with Web-Redirect, and Captive Portal allows an unauthenticated attacker to cause an extended Denial of Service (DoS) for these services by sending a high number of specific requests. This issue affects: Juniper Networks Junos OS 12.3 versions prior to 12.3R12-S17 on EX Series; 12.3X48 versions prior to 12.3X48-D105 on SRX Series; 15.1 versions prior to 15.1R7-S8; 15.1X49 versions prior to 15.1X49-D230 on SRX Series; 16.1 versions prior to 16.1R7-S8; 17.4 versions prior to 17.4R2-S12, 17.4R3-S3; 18.1 versions prior to 18.1R3-S11; 18.2 versions prior to 18.2R3-S6; 18.3 versions prior to 18.3R2-S4, 18.3R3-S3; 18.4 versions prior to 18.4R2-S5, 18.4R3-S4; 19.1 versions prior to 19.1R2-S2, 19.1R3-S2; 19.2 versions prior to 19.2R1-S5, 19.2R3; 19.3 versions prior to 19.3R2-S4, 19.3R3; 19.4 versions prior to 19.4R1-S3, 19.4R2-S2, 19.4R3; 20.1 versions prior to 20.1R1-S3, 20.1R2; 20.2 versions prior to 20.2R1-S1, 20.2R2.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-125CWE-770

Affected software

VendorProductVersions
Juniper NetworksJunos OS>= 12.3, < 12.3R12-S17
Juniper NetworksJunos OS>= 12.3X48, < 12.3X48-D105; >= 15.1X49, < 15.1X49-D230
Juniper NetworksJunos OS>= 15.1, < 15.1R7-S8; >= 16.1, < 16.1R7-S8; >= 17.4, < 17.4R2-S12, 17.4R3-S3; >= 18.1, < 18.1R3-S11; >= 18.2, < 18.2R3-S6; >= 18.3, < 18.3R2-S4, 18.3R3-S3; >= 18.4, < 18.4R2-S5, 18.4R3-S4; >= 19.1, < 19.1R2-S2, 19.1R3-S2; >= 19.2, < 19.2R1-S5, 19.2R3; >= 19.3, < 19.3R2-S4, 19.3R3; >= 19.4, < 19.4R1-S3, 19.4R2-S2, 19.4R3; >= 20.1, < 20.1R1-S3, 20.1R2; >= 20.2, < 20.2R1-S1, 20.2R2

References

Timeline

Published
Apr 22, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-02626.5Through routine static code analysis of the Juniper Networks Junos OS software codebase, the Secure Development Life Cycle team identified aCVE-2021-02635.9A Data Processing vulnerability in the Multi-Service process (multi-svcs) on the FPC of Juniper Networks Junos OS on the PTX Series routers CVE-2021-02647.5A vulnerability in the processing of traffic matching a firewall filter containing a syslog action in Juniper Networks Junos OS on MX SeriesCVE-2021-02658.1An unvalidated REST API in the AppFormix Agent of Juniper Networks AppFormix allows an unauthenticated remote attacker to execute commands aCVE-2021-02669.8The use of multiple hard-coded cryptographic keys in cSRX Series software in Juniper Networks Junos OS allows an attacker to take control ofCVE-2021-02676.5An Improper Input Validation vulnerability in the active-lease query portion in JDHCPD's DHCP Relay Agent of Juniper Networks Junos OS allowCVE-2021-02689.3An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') weakness in J-web of Juniper Networks Junos OS leadCVE-2021-02698.8The improper handling of client-side parameters in J-Web of Juniper Networks Junos OS allows an attacker to perform a number of different maCVE-2021-02705.9On PTX Series and QFX10k Series devices with the "inline-jflow" feature enabled, a use after free weakness in the Packet Forwarding Engine (CVE-2021-02716.5A Double Free vulnerability in the software forwarding interface daemon (sfid) process of Juniper Networks Junos OS allows an adjacently-conCVE-2021-02726.5A kernel memory leak in QFX10002-32Q, QFX10002-60C, QFX10002-72Q, QFX10008, QFX10016 devices Flexible PIC Concentrators (FPCs) on Juniper NeCVE-2021-02735.3An always-incorrect control flow implementation in the implicit filter terms of Juniper Networks Junos OS and Junos OS Evolved on ACX5800, E