---
id: "CVE-2026-103410"
kind: "vulnerability"
aliases: ["CVE-2026-103410"]
title: "Juniper Session Smart Router: crafted TLS certificate crashes the DPI scanner"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Session Smart Router", "fixed": ["7.0.5", "7.1.7", "7.2.3"], "affected": "< 7.0.5; 7.1.x < 7.1.7; 7.2.x < 7.2.3", "ecosystem": "vendor"}]
ecosystems: []
tags: ["denial-of-service", "infrastructure", "juniper", "network-appliance", "session-smart-router"]
not_affected_if: ["unknown"]
published_at: "2026-10-28T17:17:28+00:00"
first_seen_at: "2026-10-28T17:34:08+00:00"
updated_at: "2026-10-28T17:36:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103410", "first_seen_at": "2026-10-28T17:34:08+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-28T17:36:26+00:00"}]
---

# Juniper Session Smart Router: crafted TLS certificate crashes the DPI scanner

Integer overflow in the DPI certificate scanner of Juniper Session Smart Router lets a remote unauthenticated attacker crash it with a crafted TLS certificate. Juniper's JSA112528 lists patch releases 7.0.5, 7.1.7 and 7.2.3.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Session Smart Router affected < 7.0.5; 7.1.x < 7.1.7; 7.2.x < 7.2.3 fixed 7.0.5, 7.1.7, 7.2.3

## How to check

Run the SSR version command (e.g. show system version on the router/Conductor) and compare to 7.0.5 / 7.1.7 / 7.2.3. Whether DPI certificate scanning is configured: unknown, not stated in the advisory.

## Fix

Upgrade SSR/Conductor to the patch release for your branch: 7.0.5, 7.1.7 or 7.2.3 (JSA112528, covers the batch; per-CVE mapping not stated). No workaround per Juniper.

## Timeline

- 2026-10-28T17:34:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-103410
- 2026-10-28T17:36:26+00:00 analyst — Juniper JSA112528 (read via browser) lists patch releases 7.0.5, 7.1.7, 7.2.3 for all SSR/Conductor, disclosure date Oct 28; it names no CVEs, so mapping to this CVE and DPI default-on status are unconfirmed. Nothing marked verified. No exploitation or PoC found.

## Documents

- [advisory] On Demand: Session Smart Router (SSR) and Conductor patch release notification (HPE/Juniper, 2026-10-16) https://supportportal.juniper.net/s/article/On-Demand-Session-Smart-Router-SSR-and-Conductor-patch-release-notification
- [mentions] CERT-FR AVI-1337: Juniper SSR (cites JSA112528, 16 Oct 2026; no CVE ids) https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1337/

## From the sources

An Integer Overflow vulnerability in the DPI certificate scanner in Juniper Networks Session Smart Router allows an unauthenticated remote attacker to cause a denial of service via a specially crafted TLS server certificate.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_