CVE-2019-0052

highpriority · track · 31EPSS 0.018 · 79 %ileEURUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

1.84% (79th) EPSS

CVSS 7.8 · high

Is it mine?

24 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · fstec_bdu · nvd

EPSS · scored 2026-10-27

The srxpfe process may crash on SRX Series services gateways when the UTM module processes a specific fragmented HTTP packet. The packet is misinterpreted as a regular TCP packet which causes the processor to crash. This issue affects all SRX Series platforms that support URL-Filtering and have web-filtering enabled. Affected releases are Juniper Networks Junos OS: 12.3X48 versions prior to 12.3X48-D85 on SRX Series; 15.1X49 versions prior to 15.1X49-D181, 15.1X49-D190 on SRX Series; 17.3 versions on SRX Series; 17.4 versions prior to 17.4R1-S8, 17.4R2-S5, 17.4R3 on SRX Series; 18.1 versions prior to 18.1R3-S6 on SRX Series; 18.2 versions prior to 18.2R2-S1, 18.2R3 on SRX Series; 18.3 versions prior to 18.3R1-S2, 18.3R2 on SRX Series; 18.4 versions prior to 18.4R1-S1, 18.4R2 on SRX Series.

cvss

Technical severity, 0–10. One row per scoring source.

7.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.9–7.8

v2.07.8highAV:N/AC:L/Au:N/C:N/I:N/A:Cprimary · NVD / NIST USexploitability 10 · impact 6.9

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 3.6

v3.07.5highCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · ENISA EU

v3.07.5highCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · sirt@juniper.net USexploitability 3.9 · impact 3.6

v3.17.5highAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · FSTEC (BDU) RU

v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-436USprimaryCWE-400USCWE-404US

affected products (24)

Products and version ranges known to be affected.

Juniper Networks Junos OS≤ 15.1X49 versions prior to 15.1X49-D181 and 15.1X49-D190 on SRX Seriesenisa_euvdEU
Juniper Networks Junos OS≤ 17.3 versions on SRX Seriesenisa_euvdEU
Juniper Networks Junos OS≤ 17.4 versions prior to 17.4R1-S8 and to 17.4R2-S5 and to 17.4R3 on SRX Seriesenisa_euvdEU
Juniper Networks Junos OS≤ 18.2 versions prior to 18.2R2-S1 and to 18.2R3 on SRX Seriesenisa_euvdEU
Juniper Networks Junos OS≤ 18.3 versions prior to 18.3R1-S2 and to 18.3R2 on SRX Seriesenisa_euvdEU
Juniper Networks Junos OS≤ 18.1 versions prior to 18.1R3-S6 on SRX Seriesenisa_euvdEU
Juniper Networks Junos OS≤ 12.3X48 versions prior to 12.3X48-D85 on SRX Seriesenisa_euvdEU
Juniper Networks Junos OS≤ 18.4 versions prior to 18.4R1-S1 and to 18.4R2 on SRX Seriesenisa_euvdEU
Juniper Networks Inc. JunOS≤ 17.3fstec_bduRU
Juniper Networks Inc. JunOS12.3X48 → 12.3X48-D85fstec_bduRU
Juniper Networks Inc. JunOS15.1X49 → 15.1X49-D181fstec_bduRU
Juniper Networks Inc. JunOS17.4 → 17.4R1-S8fstec_bduRU
Juniper Networks Inc. JunOS18.1 → 18.1R3-S6fstec_bduRU
Juniper Networks Inc. JunOS18.2 → 18.2R2-S1fstec_bduRU
Juniper Networks Inc. JunOS18.3 → 18.3R1-S2fstec_bduRU
Juniper Networks Inc. JunOS18.4 → 18.4R1-S1fstec_bduRU
juniper junos= 12.3x48nvdUScpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:*
juniper junos= 15.1x49nvdUScpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:*
juniper junos= 17.3nvdUScpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:*
juniper junos= 17.4nvdUScpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:*

showing 20 of 24

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu nvd NVD CVE.org MITRE

published 2019-07-11modified 2026-06-17

related (207)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2026-63030US	—OT critical	10.6% (96th)	KEV	2026-07-17
WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (C…
CVE-2025-48384US	—OT critical	4.38% (91st)	KEV	2025-07-08
Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading…
CVE-2021-40870US	critical9.8OT critical	93.0% (100th)	KEV	2021-09-13
An issue was discovered in Aviatrix Controller 6.x before 6.5-1804.1922. Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to ex…
CVE-2025-25292US	critical9.8	65.1% (99th)	—	2025-03-12
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 a…
CVE-2025-25291US	critical9.8	21.0% (98th)	—	2025-03-12
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 a…

+202 more

references (13)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan