Juniper SRX GRE Flaw CVE-2026-33792 Has No Published Workaround; Architectural Mitigations Suggested

·8 views

Juniper's security bulletin JSA112186 describes CVE-2026-33792, a stack-based buffer overflow in the srxpfe process on Junos OS for SRX Series devices, triggered by a crafted packet sent to a configured GRE tunnel. The flaw requires no authentication or user interaction and can lead to root code execution or denial of service, with a CVSS 3.1 score of 9.8. Because the vendor has published no workaround, the article argues that organizations needing GRE should reduce exposure by limiting permitted peers, relocating tunnel endpoints behind the perimeter, or wrapping GRE inside authenticated IPsec. These measures do not fix the underlying overflow but limit who can reach the flaw and what an attacker can gain. The piece also notes that internet scans returned over a thousand matching Junos assets, highlighting the need for each organization to assess its own tunnel inventory.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Why Fire Escapes Have Fallen Out of Use in Modern Buildings

A Practical Engineering blog post examines why fire escapes, once a common feature of city buildings, are less prevalent today. The article is published on the author's site and was shared on Hacker News, where it received a small amount of attention. The provided material offers only the headline, link, and engagement figures, so the specific reasons discussed in the post cannot be confirmed here. Readers interested in the engineering and regulatory factors behind the change would need to consult the full article.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

Deriving Roof Pitch and Azimuth from Drone Point Clouds Using Python

A drone survey of a roof produces a point cloud of millions of 3D points describing the surface. For solar and roofing work, the key figures are each roof plane's steepness, its facing direction, and its surface area. The approach described uses Python with techniques such as SVD, RANSAC plane fitting, and basic trigonometry to convert raw points into these measurements. The author suggests testing the method on real scans, comparing results against hand measurements, and adjusting thresholds to match the physical roof. Readers are invited to extend the work, for instance with alpha-shape area calculations or obstruction detection.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why AI Demos Stall Before Production, and What Teams Must Engineer

Impressive AI demos often take an afternoon to build, but projects can stall for months because a demo tested on a handful of hand-picked examples says little about performance on real cases. Moving to production is mostly ordinary engineering rather than model selection, covering output correctness, integration with software, permission controls, cost tracking, and safe rollout. A central practice is an evaluation set of real inputs with expected correct outputs that can be scored automatically, growing over time as production failures are added. For open-ended outputs, using a second model as a judge can scale evaluation, but it must be calibrated against human labels and its false passes and false fails tracked separately. Structured, schema-validated outputs and specific yes/no rubric questions are also recommended over vague scores or assumed-valid free text.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Developers Can Tell Whether Traffic Spikes Signal a Real Data Breach

A common security disclosure phrase says traces of unauthorized access were confirmed, but the article explains how developers can check this themselves. A sudden spike in requests or data egress on a platform like Supabase often stems from internal problems such as buggy client code, heavy unindexed queries, or large unoptimized assets rather than an external attack. Row-Level Security can block unauthenticated reads by returning empty results with a 200 status, so request volume alone does not show data was stolen. The author recommends comparing request counts against egress, reviewing HTTP status codes such as 401, 403, and 429 for signs of automated probing, and checking the network origin of unfamiliar IPs. Together these signals help distinguish harmless internal issues from genuine exposure.

0 comments Read more at DEV Community