vciy

Juniper networks junos os, improper validation of syntactic correctness of input: 10 records, one defect family

Juniper networks junos os has been reported 10 separate times for the same kind of mistake, CWE-1286, between 2022-01-19 and 2026-07-09. A defect family is our own grouping of the CVE corpus: every record naming one product and one weakness class, collected so a repeat is visible as a repeat. No public source publishes this, and what this page counts is how often this one product has gone wrong in this one way.

What this page is, and what it is not

The records are public. This grouping is not. No source publishes defect families, so we built them: every record in the corpus sorted by the product an authority named and the weakness class carried with it, 21316 families over 105586 records. This one holds every record that names Juniper networks junos os and carries CWE-1286, matched character for character. We show the join because a grouping you cannot check is a grouping you should not cite.

One record is an incident. 10 filings, between 2022-01-19 and 2026-07-09, all landing on the same weakness class in the same product, is a habit in what gets reported here, and a habit is something you can plan around. This is what we held on 2026-09-20.

A repeat is evidence about where to look. If you are reviewing Juniper networks junos os, the records below say which mistake has already been found more than once, which is the cheapest place a reviewer can start. If you are asking the vendor a question, a count under one weakness class is a better question than any single record is.

What this page cannot tell you is decided by what was joined. A product name and a weakness class settled membership, so those two values are the whole of what the page asserts. Records here may sit in the same line of code or in unrelated parts of the product, and we hold no value that separates those cases. A fixed version named in one record closes that record and says nothing about the others. And nothing here describes anyone's systems, because no value in this family connects a product name to an installation.

20222023202420252026CVE-2022-22176, published 2022-01-19CVE-2023-28985, published 2023-07-14CVE-2023-44204, published 2023-10-12CVE-2024-21595, published 2024-01-12CVE-2024-21616, published 2024-01-12CVE-2024-21598, published 2024-04-12CVE-2024-39542, published 2024-07-11CVE-2026-21917, published 2026-01-15CVE-2026-33778, published 2026-04-09CVE-2026-57026, published 2026-07-09
The 10 are spread across 4.5 years with no single year holding half of them, and the longest quiet stretch between two of them is 18 months. That is a rate rather than an episode.

The names the authorities used

One spelling, used by every authority that filed one of these records: juniper networks junos os.

Family membership: held values. Joined on the product and weakness class the assigning authorities wrote, with no model involved.

What the records offer

9 of 10 records publish a fixed version. For the other 1, held sources name none.

The earliest was published 2022-01-19 and the latest 2026-07-09. That span is how long this product kept producing this weakness, not how long any one record took to fix.

What this page does not cover

This is a family of records that read alike. It is not a shared vulnerability, not an inventory, and not a statement that one fix closes the rest. Each record's own state, its own dates and its own receipts are on its own page.

Grouped by shared product and weakness, not by shared vulnerability. Each record's own state is on its own page.

Everything this vendor has, including records outside this family:

CVE-2022-22176Junos OS: In a scenario with dhcp-security and option-82 configured jdhcpd crashes upon receipt of a malformed DHCP…CWE-1286 Improper Validation of Syntactic…
CVE-2023-28985SRX Series and MX Series: An FPC core is observed when IDP is enabled on the device and a specific malformed SSL packet…CWE-1286 Improper Validation of Syntactic…
CVE-2023-44204Junos OS and Junos OS Evolved: The rpd will crash upon receiving a malformed BGP UPDATE messageCWE-1286: Improper Validation of Syntactic…
CVE-2024-21595Junos OS: EX4100, EX4400, EX4600, QFX5000 Series: A high rate of specific ICMP traffic will cause the PFE to hangCWE-1286 Improper Validation of Syntactic…
CVE-2024-21598Junos OS and Junos OS Evolved: A malformed BGP tunnel encapsulation attribute will lead to an rpd crashCWE-1286 Improper Validation of Syntactic…
CVE-2024-21616Junos OS: MX Series and SRX Series: Processing of a specific SIP packet causes NAT IP allocation to failCWE-1286: Improper Validation of Syntactic…
CVE-2024-39542Junos OS and Junos OS Evolved: A malformed CFM packet or specific transit traffic leads to FPC crash1286 Improper Validation of Syntactic…
CVE-2026-21917Junos OS: SRX Series: Specifically malformed SSL packet causes FPC crashCWE-1286 Improper Validation of Syntactic…
CVE-2026-33778Junos OS: SRX Series, MX Series: When a specifically malformed first ISAKMP packet is received kmd/iked crashesCWE-1286 Improper Validation of Syntactic…
CVE-2026-57026Junos OS: MX Series with SPC3, SRX Series: Processing of a specifically malformed SIP invite causes a flowd crashCWE-1286 Improper Validation of Syntactic…

10 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.

Everything on this page is free. Public data. Withholding it protects nothing.