{"api_version":"1","generated_at":"2026-10-29T03:48:00+00:00","cve":"CVE-2026-103405","urls":{"html":"https://cve.report/CVE-2026-103405","api":"https://cve.report/api/cve/CVE-2026-103405.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-103405","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-103405"},"summary":{"title":"Session Smart Router and Session Smart Conductor: Unsanitized input causes HTTP response splitting","description":"An Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the web server in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker to inject arbitrary HTTP headers via unsanitized request body parameters.","state":"PUBLISHED","assigner":"juniper","published_at":"2026-10-28 17:17:25","updated_at":"2026-10-28 17:17:25"},"problem_types":["CWE-74","CWE-74 CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')"],"metrics":[{"version":"3.1","source":"sirt@juniper.net","type":"Primary","score":"5.8","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","baseScore":5.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"5.8","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.8,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","version":"3.1"}}],"references":[{"url":"https://supportportal.juniper.net/JSA112183","name":"https://supportportal.juniper.net/JSA112183","refsource":"sirt@juniper.net","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-103405","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103405","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Juniper Networks","product":"Session Smart Router","version":"affected 7.0.5 custom","platforms":[]},{"source":"CNA","vendor":"Juniper Networks","product":"Session Smart Router","version":"affected 7.1.0 7.1.7 custom","platforms":[]},{"source":"CNA","vendor":"Juniper Networks","product":"Session Smart Router","version":"affected 7.2.0 7.2.3 custom","platforms":[]},{"source":"CNA","vendor":"Juniper Networks","product":"Session Smart Conductor","version":"affected 7.0.5 custom","platforms":[]},{"source":"CNA","vendor":"Juniper Networks","product":"Session Smart Conductor","version":"affected 7.1.0 7.1.7 custom","platforms":[]},{"source":"CNA","vendor":"Juniper Networks","product":"Session Smart Conductor","version":"affected 7.2.0 7.2.3 custom","platforms":[]}],"timeline":[],"solutions":[{"source":"CNA","title":"","value":"The following software releases of Session Smart Router and Session Smart Conductor have been updated to resolve these specific issues:\n  *  7.0.5 \n\nand all subsequent releases;\n  *  7.1.7 \n\nand all subsequent releases;\n  *  7.2.3 and all subsequent releases.","time":"","lang":"en"}],"workarounds":[{"source":"CNA","title":"","value":"There are no known workarounds for this issue.","time":"","lang":"en"}],"exploits":[{"source":"CNA","title":"","value":"Juniper SIRT is not aware of any malicious exploitation of this vulnerability.","time":"","lang":"en"}],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Session Smart Router","vendor":"Juniper Networks","versions":[{"lessThan":"7.0.5","status":"affected","version":"0","versionType":"custom"},{"lessThan":"7.1.7","status":"affected","version":"7.1.0","versionType":"custom"},{"lessThan":"7.2.3","status":"affected","version":"7.2.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Session Smart Conductor","vendor":"Juniper Networks","versions":[{"lessThan":"7.0.5","status":"affected","version":"0","versionType":"custom"},{"lessThan":"7.1.7","status":"affected","version":"7.1.0","versionType":"custom"},{"lessThan":"7.2.3","status":"affected","version":"7.2.0","versionType":"custom"}]}],"datePublic":"2026-10-28T16:00:00.000Z","descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"An Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the web server in Juniper Networks Session Smart Router and Session Smart Conductor&nbsp;allows an attacker to inject arbitrary HTTP headers via unsanitized request body parameters."}],"value":"An Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the web server in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker to inject arbitrary HTTP headers via unsanitized request body parameters."}],"exploits":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Juniper SIRT is not aware of any malicious exploitation of this vulnerability."}],"value":"Juniper SIRT is not aware of any malicious exploitation of this vulnerability."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.8,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-74","description":"CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-28T16:35:39.369Z","orgId":"8cbe9d5a-a066-4c94-8978-4b15efeae968","shortName":"juniper"},"references":[{"tags":["vendor-advisory"],"url":"https://supportportal.juniper.net/JSA112183"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"The following software releases of Session Smart Router and Session Smart Conductor have been updated to resolve these specific issues:<br><ul><li>7.0.5 \n\nand all subsequent releases;</li><li>7.1.7 \n\nand all subsequent releases;</li><li>7.2.3 and all subsequent releases.</li></ul>\n\n<br>\n\n<br>"}],"value":"The following software releases of Session Smart Router and Session Smart Conductor have been updated to resolve these specific issues:\n  *  7.0.5 \n\nand all subsequent releases;\n  *  7.1.7 \n\nand all subsequent releases;\n  *  7.2.3 and all subsequent releases."}],"source":{"advisory":"JSA112183","defect":["I95-65039"],"discovery":"INTERNAL"},"title":"Session Smart Router and Session Smart Conductor: Unsanitized input causes HTTP response splitting","workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"There are no known workarounds for this issue."}],"value":"There are no known workarounds for this issue."}],"x_generator":{"engine":"Vulnogram 0.1.0-dev"}}},"cveMetadata":{"assignerOrgId":"8cbe9d5a-a066-4c94-8978-4b15efeae968","assignerShortName":"juniper","cveId":"CVE-2026-103405","datePublished":"2026-10-28T16:35:39.369Z","dateReserved":"2026-09-30T14:33:03.168Z","dateUpdated":"2026-10-28T16:35:39.369Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-28 17:17:25","lastModifiedDate":"2026-10-28 17:17:25","problem_types":["CWE-74","CWE-74 CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')"],"metrics":{"cvssMetricV31":[{"source":"sirt@juniper.net","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","baseScore":5.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"103405","Ordinal":"1","Title":"Session Smart Router and Session Smart Conductor: Unsanitized in","CVE":"CVE-2026-103405","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"103405","Ordinal":"1","NoteData":"An Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the web server in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker to inject arbitrary HTTP headers via unsanitized request body parameters.","Type":"Description","Title":"Session Smart Router and Session Smart Conductor: Unsanitized in"}]}}}