Aggregated advisories hide pairings. JSA112186 lists many CVE identifiers against Junos OS on SRX Series, and the instinct is to sort by score and stop reading. Two entries in that bulletin belong together because they land in the same process, share the same fixed builds, and punish different deployments.

The two flaws

The first entry, CVE-2026-33792, is a stack-based buffer overflow, CWE-121, in srxpfe. The description is direct: a crafted packet received on a configured GRE tunnel lets an unauthenticated network attacker execute code as root or cause denial of service. CVSS 3.1 assigns 9.8 with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and CVSS 4.0 assigns 9.3.
The second entry, CVE-2026-101937, is a signed-to-unsigned conversion error, CWE-195, also in srxpfe. Its description is narrower: an adjacent attacker can cause a denial of service of the data plane via chassis-cluster fabric traffic. CVSS 3.1 assigns 6.5 with AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, and CVSS 4.0 assigns 7.1.

Where they diverge

The attack vector is the dividing line. Network reachability means a packet arriving over a routed path from anywhere the tunnel endpoint is exposed. Adjacent means the attacker sits on the fabric side, in practice inside the chassis cluster rather than outside the estate.
The impact differs as well. The overflow leads with code execution as root and treats denial of service as the alternative outcome. The conversion error records no confidentiality or integrity impact: it is a data-plane availability failure.

Where they converge

Both sit in the same forwarding process. Both are unauthenticated and require no user interaction. Both are fixed in the same set of releases: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2 and 26.4R1, with later builds carrying the fixes. Junos OS Evolved also receives corresponding fixes for the second issue in the matching EVO builds.
That convergence is the operational point. There is no partial patch for a mixed SRX estate. One upgrade window closes both, and one missed device keeps both open.

Who carries which risk

GRE tunnel termination on SRX Series is the condition for the overflow. Sites using SRX mainly as a stateful firewall with IPsec and no GRE may carry little practical exposure to it.
Chassis-cluster high availability is the condition for the conversion error. Sites running SRX in an HA pair carry it regardless of GRE use, because the trigger is cluster-internal traffic.
The two conditions overlap often enough that many enterprises hold both: HA pairs that also terminate GRE for site interconnect. For those deployments this is not a prioritisation exercise, it is one change ticket.

What the vendor leaves unsaid

Juniper states there are no known workarounds for either issue. Neither description names the vulnerable function or the field carrying the malformed value. Neither advisory reports observed exploitation.
The containment story for the conversion error is stronger than the score suggests. An adjacent vector requires a position inside the cluster fabric, which is a real barrier for an external actor and a weak one for anyone who already holds a foothold on a cluster member. That is a lateral-movement dependency rather than a perimeter exposure.

Patch verification, concretely

The fixed list includes respins for the 23.2, 23.4 and 24.2 trains, and Juniper notes those releases were rebuilt. Comparing an installed build against the train name is not verification. The exact build identifier has to match a listed fixed build or something later.
After the upgrade, confirm that forwarding still passes tunnel traffic, that cluster failover still behaves where HA is deployed, and that process supervision shows no new crash pattern.

The aggregate record problem

Both identifiers arrived inside CERT-BUND record WID-SEC-2026-3976, which carries well over a hundred Junos OS identifiers. Feeds of that shape make triage by severity easy and triage by process rare. The reading offered here is deliberately narrow: two identifiers, one process, one window.

References

  • Juniper Networks security bulletin JSA112186: https://supportportal.juniper.net/JSA112186

  • CVE.org record for the buffer overflow: https://www.cve.org/CVERecord?id=CVE-2026-33792

  • CVE.org record for the conversion error: https://www.cve.org/CVERecord?id=CVE-2026-101937

  • CERT-BUND advisory WID-SEC-2026-3976: https://wid.cert-bund.de/content/public/content/b6a2aff7-6ffb-4195-8879-c9537ac004dd