Junos OS: SRX Series: High CPU load due to processing for HTTP traffic when Application Identification is enabled.

Description

On Juniper Networks SRX Series configured with application identification inspection enabled, receipt of specific HTTP traffic can cause high CPU load utilization, which could lead to traffic interruption. Application identification is enabled by default and is automatically turned on when Intrusion Detection and Prevention (IDP), AppFW, AppQoS, or AppTrack is configured. Thus, this issue might occur when IDP, AppFW, AppQoS, or AppTrack is configured. This issue affects Juniper Networks Junos OS on SRX Series: 12.3X48 versions prior to 12.3X48-D105; 15.1X49 versions prior to 15.1X49-D221, 15.1X49-D230; 17.4 versions prior to 17.4R3-S3; 18.1 versions prior to 18.1R3-S11; 18.2 versions prior to 18.2R3-S3; 18.3 versions prior to 18.3R2-S4, 18.3R3-S2; 18.4 versions prior to 18.4R2-S5, 18.4R3-S1; 19.1 versions prior to 19.1R2-S2, 19.1R3; 19.2 versions prior to 19.2R1-S5, 19.2R2; 19.3 versions prior to 19.3R3; 19.4 versions prior to 19.4R2.

Scores

EPSS (exploitation in 30 days)

1.1% · top 35% of all CVEs (7 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

• CWE-400 Uncontrolled Resource Consumption (opens in a new tab)All about CWE-400 and its CVEs

Affected products

• Juniper Networks · Junos OS

  • affected 12.3X48 – < 12.3X48-D105
  • affected 15.1X49 – < 15.1X49-D221, 15.1X49-D230
  • affected 17.4 – < 17.4R3-S3
  • affected 18.1 – < 18.1R3-S11
  • affected 18.2 – < 18.2R3-S3
  • affected 18.3 – < 18.3R2-S4, 18.3R3-S2
  • affected 18.4 – < 18.4R2-S5, 18.4R3-S1
  • affected 19.1 – < 19.1R2-S2, 19.1R3
  • affected 19.2 – < 19.2R1-S5, 19.2R2
  • affected 19.3 – < 19.3R3
  • affected 19.4 – < 19.4R2

What to do

Solution: The following software releases have been updated to resolve this specific issue: Junos OS 12.3X48-D105, 15.1X49-D221, 15.1X49-D230, 17.4R3-S3, 18.1R3-S11, 18.2R3-S3, 18.3R2-S4, 18.3R3-S2, 18.4R2-S5, 18.4R3-S1, 19.1R2-S2, 19.1R3, 19.2R1-S5, 19.2R2, 19.3R3, 19.4R2, 20.1R1,and all subsequent releases.

Workaround: There are no viable workarounds for this issue.

Exploitation: Juniper SIRT is not aware of any malicious exploitation of this vulnerability.

References (1)

• https://kb.juniper.net/JSA11081 (opens in a new tab)x_refsource_CONFIRMx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2020-1684](https://trackcve.app/badge/CVE-2020-1684.svg)](https://trackcve.app/cve/CVE-2020-1684)

Record last updated 17 Sept 2024, 03:18 UTC.