EUVD-2026-42701
GHSA-cxfq-ph57-rvh2
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:X/RE:M/U:X
Adjacent BFD peering (AV:A) with low-complexity flapping and no auth (AC:L/PR:N), availability-only FPC crash (A:H, C:N/I:N); scope kept Unchanged as the FPC is the vulnerable component.
Primary rating from Vendor (juniper).
CVSS VectorVendor: juniper
Lifecycle Timeline
2DescriptionCVE.org
An Unchecked Input for Loop Condition vulnerability in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS on MX Series allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS).Micro-BFD session flaps generate respective up/down events which are queued by PFEMAN for processing. Especially in a Virtual-Chassis (VC) scenario with locality‑bias configured, processing takes a significant amount of time for each event. If these sessions keep flapping, new events are constantly added, and in turn PFEMAN never completes processing these events. This results in the PFEMAN watchdog timer expiring, which causes the FPC to crash and restart, representing a complete service outage.
This issue only affects MX series FPCs up to and including MPC9. It does not affect MPC10/11, LC4800/9600 and MX304.
This issue affects Junos OS on MX Series:
- all versions before 23.2R2-S7,
- 23.4 versions before 23.4R2-S8,
- 24.2 versions before 24.2R2-S4,
- 24.4 versions before 24.4R2-S3,
- 25.2 versions before 25.2R2.
Articles & Coverage 2
AnalysisAI
Denial-of-service in the Packet Forwarding Engine of Juniper Junos OS on MX Series routers allows an unauthenticated, network-adjacent attacker to crash and restart the FPC by continuously flapping Micro-BFD sessions. The PFEMAN process queues each up/down event and, in a Virtual-Chassis deployment with locality-bias enabled, processing is slow enough that a sustained flap backlog prevents completion and trips the PFEMAN watchdog timer, forcing an FPC restart and a full traffic outage. No public exploit identified at time of analysis and the issue is not in CISA KEV, but the low complexity and unauthenticated adjacent vector make it a credible availability threat to affected line cards (MPC9 and below).
Technical ContextAI
The flaw lives in PFEMAN, the PFE management component that serializes and processes Bidirectional Forwarding Detection (BFD) state-change events on the line card. Micro-BFD is the per-member-link BFD variant used to monitor individual links inside a LAG/aggregated bundle, and each session transition generates an up or down event that PFEMAN must handle. The root cause maps to CWE-606 (Unchecked Input for Loop Condition): the event-processing loop is driven by an externally influenced input (the incoming stream of session flap events) with no bound, so an attacker-controlled arrival rate can keep the loop from ever terminating. Virtual-Chassis with locality-bias configuration makes each event significantly more expensive to process, widening the window in which new events are enqueued faster than existing ones drain, until the PFEMAN watchdog fires and restarts the FPC. Because the CVSS 4.0 vector reports VA:H with VC:N/VI:N, the impact is purely availability - no data disclosure or modification.
RemediationAI
Vendor-released patches are available - upgrade to the fixed release for your train: 23.2R2-S7 or later, 23.4R2-S8 or later, 24.2R2-S4 or later, 24.4R2-S3 or later, or 25.2R2 or later, per Juniper advisory JSA110075 (https://supportportal.juniper.net/JSA110075). Where immediate patching is not possible, reduce exposure by addressing the exploitation preconditions: on affected MPC9-and-below line cards, reconsider or disable the Virtual-Chassis locality-bias configuration that makes per-event processing slow (trade-off: locality-bias optimizes intra-VC traffic paths, so removing it can increase inter-member forwarding and fabric load), and stabilize Micro-BFD so sessions do not flap - for example by tuning BFD timers to be less aggressive or restricting BFD peering to trusted, authenticated adjacencies (trade-off: slower BFD detection increases failover time). Restricting Layer-2 adjacency and BFD peer reachability to trusted neighbors limits the adjacent attack surface. As a hardware-level option, migrating affected workloads to unaffected line cards (MPC10/11, LC4800/9600) or MX304 removes the vulnerable path.
named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 does not properly handle DNAME records when parsing fe
named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 allows remote attackers to cause a denial of service (
A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series and SRX Series all
jsdm/ajax/port.php in J-Web in Juniper Junos before 10.4R13, 11.4 before 11.4R7, 12.1 before 12.1R5, 12.2 before 12.2R3,
Juniper Junos 11.4 before R11, 12.1 before R9, 12.1X44 before D30, 12.1X45 before D20, 12.1X46 before D15, 12.1X47 befor
NFX Series devices using Juniper Networks Junos OS are susceptible to a local command execution vulnerability thereby al
NFX Series devices using Juniper Networks Junos OS are susceptible to a local code execution vulnerability thereby allow
Insufficient validation of environment variables in the telnet client supplied in Junos OS can lead to stack-based buffe
An Out-of-Bounds Write vulnerability in the H.323 ALG of Juniper Networks Junos OS allows an unauthenticated, network-ba
On QFX10000 Series devices using Juniper Networks Junos OS when configured as transit IP/MPLS penultimate hop popping (P
A Missing Release of Memory after Effective Lifetime vulnerability in the kernel of Juniper Networks Junos OS allows an
An Uncontrolled Memory Allocation vulnerability leading to a Heap-based Buffer Overflow in the packet forwarding engine
Same weakness CWE-606 – Unchecked Input for Loop Condition
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today