p PatchFirst

CVE-2026-103405

CVE-2026-103405 · Session Smart Router and Session Smart Conductor: Unsanitized input causes HTTP response splitting

This page contains facts from public vulnerability sources. Check the original advisory before updating.

An Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the web server in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker to inject arbitrary HTTP headers via unsanitized request body parameters.

CVSS 5.8 · Medium · EPSS 0.2% · Fix available

Published
Updated

Affected products and versions

  • session smart router

    Versions
    • ≥ 0, < 7.0.5: Affected (custom)
    • ≥ 7.1.0, < 7.1.7: Affected (custom)
    • ≥ 7.2.0, < 7.2.3: Affected (custom)

    Update to 7.0.5; Update to 7.1.7; Update to 7.2.3

  • session smart conductor

    Versions
    • ≥ 0, < 7.0.5: Affected (custom)
    • ≥ 7.1.0, < 7.1.7: Affected (custom)
    • ≥ 7.2.0, < 7.2.3: Affected (custom)

    Update to 7.0.5; Update to 7.1.7; Update to 7.2.3

Original sources

Check your server →