CVE-2026-33780
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
In an EVPN-MPLS scenario, routes learned from remote multi-homed PE devices are programmed as ESI routes, and due to a logic issue in l2ald memory management, memory allocated for these routes is not released during churn, causing a memory leak that ultimately leads to a crash and restart of l2ald. Affects multiple Junos OS and Junos OS Evolved releases before specified fixed versions.
Risk Assessment
An adjacent unauthenticated attacker can trigger a memory leak leading to a Denial of Service (DoS).
Recommendation
Upgrade Junos OS and Junos OS Evolved to fixed releases (e.g., 22.4R3-S5, 23.2R2-S3, 23.4R2-S4, 24.2R2 and corresponding EVO versions). Monitor l2ald memory consumption.
Other vulnerabilities in Junos OS
See all- CVE-2026-21917High
A vulnerability in the Web-Filtering module of Junos OS on SRX Series allows an unauthenticated network-based attacker to cause a Denial-of-Service (DoS). A specially crafted SSL packet causes an FPC crash and restart.
- CVE-2026-21913High
A vulnerability in Juniper Junos OS on EX4000 models with 48 ports (EX4000-48T, EX4000-48P, EX4000-48MP) allows an unauthenticated network-based attacker to cause an FXPC crash and restart by sending a high volume of traffic to the device. This leads to a complete service outage until the device automatically restarts.
- CVE-2026-21905High
A vulnerability in Junos OS on SRX and MX devices with MX-SPC3 or MS-MPC service cards causes an infinite loop in the flow management process (flowd or mspmand) after receiving specific SIP messages over TCP. An unauthenticated attacker can send multiple such messages, leading to watchdog timer expiration and process crash, resulting in a Denial of Service (DoS). The issue only occurs over TCP, not UDP.
- CVE-2025-60003High
A Buffer Over-read vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). When an affected device receives a BGP update with a set of specific optional transitive attributes over an established peering session, rpd will crash and restart when attempting to advertise the received information to another peer.
- CVE-2025-59960High
A vulnerability in the DHCP service (jdhcpd) of Junos OS and Junos OS Evolved allows a DHCP client in one subnet to exhaust the address pools of other subnets, leading to a Denial of Service (DoS) on the downstream DHCP server. The issue arises from improper handling of DHCP DISCOVER packets with Option 82 in 'forward-only' mode, which are forwarded unmodified instead of being dropped, consuming addresses from the pool.
- CVE-2016-4922High
A vulnerability in Junos OS allows unauthorized access to the operating system through certain combinations of CLI commands. Users with the appropriate permissions can achieve elevated privileges and gain complete control of the device.
- CVE-2017-2344High
An internal Junos OS sockets library is vulnerable to a buffer overflow, which may lead to a denial of service (kernel panic) or privilege escalation through local code execution. The routines are only accessible via programs running on the device.
- CVE-2017-2303High
On Juniper Networks products or platforms running Junos OS versions prior to 12.1X46-D50, 12.1X47-D40, 12.3R13, 12.3X48-D30, 13.2X51-D40, 13.3R10, 14.1R8, 14.1X53-D35, 14.1X55-D35, 14.2R5, 15.1F6, 15.1R3, 15.1X49-D30, 15.1X49-D40, 15.1X53-D35, where RIP is enabled, certain RIP advertisements may cause the RPD daemon to crash, resulting in a denial of service condition.
- CVE-2017-2302High
On Juniper Networks products running Junos OS versions prior to 12.1X46-D55, 12.1X47-D45, 12.3R13, 12.3X48-D35, 13.3R10, 14.1R8, 14.1X53-D40, 14.1X55-D35, 14.2R6, 15.1F2 or 15.1R1, where the BGP add-path feature is enabled with 'send' option or with both 'send' and 'receive' options, a network-based attacker can cause the rpd daemon to crash and restart. Repeated crashes of the rpd daemon can result in an extended denial of service condition.
- CVE-2017-2301High
On Juniper Networks products running Junos OS versions prior to 11.4R13-S3, 12.1X46-D60, 12.3R12-S2, 13.2X51-D40, 13.3R10, 14.1R8, 14.1X53-D12, 14.1X55-D35, 14.2R7, 15.1F6, 15.1R3, 15.1X49-D60, and 15.1X53-D30, when DHCPv6 is enabled, receiving a crafted DHCPv6 packet causes the jdhcpd daemon to crash and restart. Repeated crashes of the jdhcpd process may lead to an extended denial of service condition for subscribers attempting to obtain IPv6 addresses.
Original NVD description (English source)
A Missing Release of Memory after Effective Lifetime vulnerability in the Layer 2 Address Learning Daemon (l2ald) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated attacker to cause a memory leak ultimately leading to a Denial of Service (DoS). In an EVPN-MPLS scenario, routes learned from remote multi-homed Provider Edge (PE) devices are programmed as ESI routes. Due to a logic issue in the l2ald memory management, memory allocated for these routes is not released when there is churn for these routes. As a result, memory leaks in the l2ald process which will ultimately lead to a crash and restart of l2ald. Use the following command to monitor the memory consumption by l2ald: user@device> show system process extensive | match "PID|l2ald" This issue affects: Junos OS: * all versions before 22.4R3-S5, * 23.2 versions before 23.2R2-S3, * 23.4 versions before 23.4R2-S4, * 24.2 versions before 24.2R2; Junos OS Evolved: * all versions before 22.4R3-S5-EVO, * 23.2 versions before 23.2R2-S3-EVO, * 23.4 versions before 23.4R2-S4-EVO, * 24.2 versions before 24.2R2-EVO.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS