EUVD-2026-21090
GHSA-wcmx-9w9j-q7ph
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted EVPN-MPLS routes from adjacent network
-
DeliveryTrigger ESI route churn in l2ald
-
ExploitMemory allocation leak in daemon
-
ExecutionExhaust process memory
-
Impactl2ald daemon crash causing DoS
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Resource cleanup, leak prevention
|
| Exploitation Conditions | Requires EVPN-MPLS deployment on Juniper Junos OS/Junos OS Evolved with multi-homed Provider Edge (PE) devices. Attacker must be adjacent (same network segment) and unauthenticated. No user interaction needed. Memory exhaustion occurs through route churn in ESI route learning. |
| Impact | CVSS 7.1 reflects high availability impact in EVPN-MPLS networks. Adjacent, unauthenticated attack vector with low complexity enables DoS via memory exhaustion in l2ald daemon. Moderate observed exploitation activity. Wide version coverage (22.4-24.2) across Junos OS and Evolved increases exposure surface. Blast radius limited to network segment proximity, but PE device restarts disrupt service. |
| Exploit ScenarioDerived | Attacker on adjacent network segment floods ESI route churn in EVPN-MPLS deployment. Malformed or rapid route updates trigger memory leak in l2ald. Repeated cycles exhaust memory; l2ald crashes, restarting and causing temporary service disruption. No patching required for attack initiation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 09, 2026
Memory leak in Juniper Networks l2ald daemon allows adjacent attackers to crash Layer 2 services on EVPN-MPLS networks. Affects Junos OS and Junos OS Evolved across multiple versions. Unauthenticated attackers on the same network segment can trigger resource exhaustion by causing ESI route churn from multi-homed Provider Edge devices, forcing l2ald process crash and restart. No public exploit identified at time of analysis, but exploitation requires only network adjacency without authentication.
RemediationAI
Vendor-released patches: Junos OS 22.4R3-S5, 23.2R2-S3, 23.4R2-S4, 24.2R2 or later. Junos OS Evolved 22.4R3-S5-EVO, 23.2R2-S3-EVO, 23.4R2-S4-EVO, 24.2R2-EVO or later. Prioritize deployment on systems running EVPN-MPLS configurations with multi-homed PE devices. Monitor l2ald memory consumption using 'show system process extensive | match PID|l2ald' as interim detection. No workaround exists; upgrade to patched releases is required. Official advisory: https://kb.juniper.net/JSA107819. Exploitation requires network adjacency; isolate management and control-plane networks where possible.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-401 memory management flaw in l2ald daemon fails to release allocated memory for ESI routes learned from remote multi-homed PE devices in EVPN-MPLS topologies. Route churn triggers cumulative memory allocation without corresponding deallocation, causing unbounded resource consumption. CVSS:4.0 adjacency vector (AV:A) with no privilege requirement (PR:N) indicates local network exploitation.
Know when Junos Os gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/RE:M
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A Missing Release of Memory after Effective Lifetime vulnerability in the Layer 2 Address Learning Daemon (l2ald) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated attacker to cause a memory leak ultimately leading to a Denial of Service (DoS).
In an EVPN-MPLS scenario, routes learned from remote multi-homed Provider Edge (PE) devices are programmed as ESI routes. Due to a logic issue in the l2ald memory management, memory allocated for these routes is not released when there is churn for these routes. As a result, memory leaks in the l2ald process which will ultimately lead to a crash and restart of l2ald.
Use the following command to monitor the memory consumption by l2ald:
user@device> show system process extensive | match "PID|l2ald"
This issue affects:
Junos OS:
- all versions before 22.4R3-S5,
- 23.2 versions before 23.2R2-S3,
- 23.4 versions before 23.4R2-S4,
- 24.2 versions before 24.2R2;
Junos OS Evolved:
- all versions before 22.4R3-S5-EVO,
- 23.2 versions before 23.2R2-S3-EVO,
- 23.4 versions before 23.4R2-S4-EVO,
- 24.2 versions before 24.2R2-EVO.
Executive ViewAI
CVE-2026-33780 affects Juniper Networks Junos OS and Junos OS Evolved, enabling unauthenticated adjacent network attackers to crash Layer 2 services via resource exhaustion in the l2ald daemon, disrupting EVPN-MPLS network operations. Organizations operating Juniper routing and switching infrastructure face potential denial-of-service impact to critical Layer 2 connectivity, particularly in multi-homed network topologies. Remediation is available and should be prioritized for all affected platforms in production environments.
Apply vendor patch. Interim mitigations pending patch deployment: restrict network access to devices capable of triggering ESI route churn from untrusted network segments; implement network segmentation to limit Layer 2 adjacency exposure; monitor l2ald process stability and restart frequency via device logging and alerting for early detection of exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
OS command injection in the phcd phone-home daemon of Juniper Networks Junos OS and Junos OS Evolved lets an adjacent, u
Unauthenticated remote code execution with root privileges affects Juniper Networks Junos OS devices that expose the J-W
Heap-based buffer overflow in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allow
A stack-based buffer overflow in the srxpfe packet forwarding process of Juniper Networks Junos OS on SRX Series devices
Unauthenticated remote code execution with elevated privileges is possible in Juniper Junos OS and Junos OS Evolved thro
Remote root code execution in the routing protocol daemon (rpd) of Juniper Junos OS is reachable through protocol-valid
Remote code execution (on Junos OS) and rpd denial of service (on Junos OS and Junos OS Evolved) result from a stack-bas
Remote code execution with root privileges on Juniper Networks Junos OS and Junos OS Evolved is possible when the routin
Remote code execution and denial of service in Juniper Networks Junos OS and Junos OS Evolved arise from a stack-based b
Unauthenticated remote attackers can gain root-level configuration access and fully compromise Juniper Junos OS and Juno
Integer underflow in the Junos OS kernel can crash a device when the Extended Echo feature (RFC 8335 ICMP probing) is co
Heap-based buffer overflow in Juniper Networks Junos OS on SRX Series devices that have Secure Vector Routing (SVR) enab
Exploit-DB