CVE-2026-103390
Session Smart Router and Session Smart Conductor: A malformed HTTP URI causes a service crash during HTTP application identification
Juniper Networks Session Smart RouterNetwork & edge
CVSS
5.3MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 7.0.5Session Smart RouterCVE List
- 7.1.7Session Smart RouterCVE List
- 7.2.3Session Smart RouterCVE List
- 7.0.5Session Smart ConductorCVE List
- 7.1.7Session Smart ConductorCVE List
- 7.2.3Session Smart ConductorCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
An Out-of-Bounds Read vulnerability in the HttpParser component in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker to cause a denial of service via a specially crafted HTTP request.
Text from CVE List
Affected versions 6
- Session Smart Routeraffected: all versions before 7.0.5CVE List
- Session Smart Routeraffected: 7.1.0 before 7.1.7CVE List
- Session Smart Routeraffected: 7.2.0 before 7.2.3CVE List
- Session Smart Conductoraffected: all versions before 7.0.5CVE List
- Session Smart Conductoraffected: 7.1.0 before 7.1.7CVE List
- Session Smart Conductoraffected: 7.2.0 before 7.2.3CVE List