{"id":"CVE-2026-103391","kind":"vulnerability","aliases":["CVE-2026-103391"],"related":[],"title":"Juniper Session Smart Router: TCP option parsing writes out of bounds","description":"An Out-of-bounds Write vulnerability in the SSR TCP proxy/optimization path in Juniper Networks Session Smart Router allows an attacker to corrupt forwarded packet data and potentially cause a data-plane crash via a transit TCP packet with a crafted TCP option length.","summary":"A flaw in the TCP proxy and optimization path of Juniper's Session Smart Router lets a crafted transit TCP packet with a bad option length write past a buffer. An attacker can corrupt forwarded packet data and may crash the data plane.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","juniper","network-appliance","session-smart-router"],"not_affected_if":["no-juniper-ssr"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-28T17:17:22+00:00","first_seen_at":"2026-10-28T17:34:08+00:00","triaged_at":"2026-10-28T17:34:40+00:00","updated_at":"2026-10-28T17:34:40+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-28T17:34:40Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Juniper Session Smart Router: TCP option parsing writes out of bounds","impact":"medium","summary":"A flaw in the TCP proxy and optimization path of Juniper's Session Smart Router lets a crafted transit TCP packet with a bad option length write past a buffer. An attacker can corrupt forwarded packet data and may crash the data plane.","category":"infrastructure","nicknames":[],"who_cares":["juniper","session-smart-router","network-appliance"],"confidence":0.5,"needs_auth":"no","worst_case":"Forwarded packet data corrupted and data-plane crash via transit packet","analyst_note":"Find the Juniper SSR security advisory for CVE-2026-103391 to confirm affected and fixed versions and whether the TCP proxy feature must be enabled.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-juniper-ssr"],"who_is_affected":"Sources do not name the affected Session Smart Router versions or whether the SSR TCP proxy/optimization feature must be enabled. Teams running Juniper Session Smart Routers should check the vendor advisory for affected releases and whether TCP proxy or optimization is in use. Teams without Juniper SSR gear can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000577,"input_tokens":3326,"output_tokens":489,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-103391':14A,17A '-2026':13A,16A 'allow':89C 'applianc':22B 'attack':58B,91C 'bad':50B 'bound':11A,74C 'buffer':56B 'caus':99C 'corrupt':60B,93C 'craft':44B,112C 'crash':66B,104C 'cve':12A,15A 'data':63B,68B,96C,102C 'data-plan':101C 'flaw':28B 'forward':61B,94C 'infrastructur':18B 'junip':1A,19B,37B,84C 'length':52B,115C 'let':42B 'may':65B 'network':21B,85C 'network-appli':20B 'optim':34B 'option':6A,51B,114C 'out-of-bound':71C 'packet':47B,62B,95C,109C 'pars':7A 'past':54B 'path':35B,82C 'plane':69B,103C 'potenti':98C 'proxi':32B 'proxy/optimization':81C 'router':4A,26B,41B,88C 'session':2A,24B,39B,86C 'session-smart-rout':23B 'smart':3A,25B,40B,87C 'ssr':79C 'tcp':5A,31B,46B,80C,108C,113C 'transit':45B,107C 'via':105C 'vulner':76C 'write':8A,53B,75C","nicknames":[],"mitigations":[],"who_affected":"Sources do not name the affected Session Smart Router versions or whether the SSR TCP proxy/optimization feature must be enabled. Teams running Juniper Session Smart Routers should check the vendor advisory for affected releases and whether TCP proxy or optimization is in use. Teams without Juniper SSR gear can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T17:17:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"sirt@juniper.net","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103391","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103391","severity":null,"published_at":"2026-10-28T17:17:22+00:00","modified_at":"2026-10-28T17:17:22+00:00","first_seen_at":"2026-10-28T17:34:08+00:00","fetched_at":"2026-10-28T17:34:08+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}