CVE-2024-47506

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

A Deadlock vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS).

When a large amount of traffic is processed by ATP Cloud inspection, a deadlock can occur which will result in a PFE crash and restart. Whether the crash occurs, depends on system internal timing that is outside the attackers control.

This issue affects Junos OS on SRX Series:

* All versions before 21.3R3-S1, * 21.4 versions before 21.4R3, * 22.1 versions before 22.1R2, * 22.2 versions before 22.2R1-S2, 22.2R2.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-833

Affected software

No affected versions have been published.

Timeline

Published
Oct 11, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-475075.8An Improper Check for Unusual or Exceptional Conditions vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and CVE-2024-475086.5An Allocation of Resources Without Limits or Throttling vulnerability in the PFE management daemon (evo-pfemand) of Juniper Networks Junos OCVE-2024-475096.5An Allocation of Resources Without Limits or Throttling vulnerability in the PFE management daemon (evo-pfemand) of Juniper Networks Junos OCVE-2024-47514.3The WP Prayer II WordPress plugin through 2.4.7 does not have CSRF check in place when updating its settings, which could allow attackers toCVE-2024-475158.1A vulnerability was found in Pagure. Support of symbolic links during repository archiving of repositories allows the disclosure of local fiCVE-2024-475169.8A vulnerability was found in Pagure. An argument injection in Git during retrieval of the repository history leads to remote code execution CVE-2024-475176.8Expired and unusable administrator authentication tokens can be revealed by units that have timed out from ETM accessCVE-2024-475187.6Specially constructed queries targeting ETM could discover active remote access sessionsCVE-2024-475197.1Backup uploads to ETM subject to man-in-the-middle interceptionCVE-2024-47525.9The EventON WordPress plugin before 2.2.15 does not sanitise and escape some of its settings, which could allow high privilege users such asCVE-2024-475207.6A user with advanced report application access rights can perform actions for which they are not authorizedCVE-2024-475227.5Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.7