EUVD-2026-42706
GHSA-qwhr-x4c6-c5hc
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:X/RE:M/U:X
Adjacent Layer-2 delivery (AV:A) with no auth or interaction and low complexity, causing availability-only impact via FPC reset (A:H, C/I:N); scope unchanged as impact stays within the router.
Primary rating from Vendor (juniper).
CVSS VectorVendor: juniper
Lifecycle Timeline
8DescriptionCVE.org
An Improper Validation of Specified Quantity in Input vulnerability in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS on MX Series allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS).
When a specific packet is received from device in the same broadcast domain, an affected system calculates the packet size incorrectly. This causes further packet processing to fail, which triggers an FPC major error, resulting in a FPC reset impacting traffic until the FPC has automatically recovered.
Affected scenarios are: MAP-T, or non-IP traffic encapsulated in IP (e.g. MPLS over GRE).
When this issue happens the following logs can be observed:
fpc<#> CMError: /fpc/0/pfe/0/cm/0/MQSS(0)/0/MQSS_CMERROR_LI_INT_REG_UNROLL_TAIL_LENGTH_OVF (0x2205eb), scope: pfe, category: functional, severity: major, module: MQSS(0), type: LI: Unroll TAIL length overflow, oc_category: default fpc<#> Performing action reset-fru for error /fpc/0/pfe/0/cm/0/MQSS(0)/0/MQSS_CMERROR_LI_INT_REG_UNROLL_TAIL_LENGTH_OVF (0x2205eb) in module: MQSS(0) with scope: pfe category: functional level: major, oc_category: default
This issue affects Junos OS on MX Series:
- all versions before 23.2R2-S6,
- 23.4 versions before 23.4R2-S7,
- 24.2 versions before 24.2R2-S4,
- 24.4 versions before 24.4R2-S4,
- 25.2 versions before 25.2R2.
Articles & Coverage 1
AnalysisAI
Denial-of-service in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series routers lets an unauthenticated, Layer-2 adjacent attacker crash a line card by sending a single crafted packet within the same broadcast domain. The affected system miscalculates the packet size (CWE-1284, improper validation of specified quantity in input), which fails downstream processing and raises an MQSS major CMError that forces an automatic FPC reset, interrupting all traffic on that FPC until it recovers. Only deployments handling MAP-T or non-IP-over-IP traffic (e.g. MPLS over GRE) are exposed; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
The flaw lives in the MX Series Packet Forwarding Engine's MQSS (memory and queuing subsystem) ASIC path, specifically the 'Unroll TAIL length' logic (register MQSS_CMERROR_LI_INT_REG_UNROLL_TAIL_LENGTH_OVF, 0x2205eb). When a packet in an affected encapsulation format is processed, the PFE computes an incorrect packet size, producing a TAIL length overflow. CWE-1284 (Improper Validation of Specified Quantity in Input) is the root-cause class: a length/size field derived from the packet is trusted without proper bounds validation, so an oversized or malformed length value overflows internal processing state. Because MAP-T (Mapping of Address and Port using Translation) and IP-encapsulated non-IP payloads such as MPLS-over-GRE take special forwarding paths, only those code paths trigger the miscalculation. The CPE (cpe:2.3:a:juniper_networks:junos_os:*) confirms Junos OS broadly, but the vendor scopes impact to MX Series hardware running the listed trains.
RemediationAI
Vendor-released patch: upgrade Junos OS on MX Series to a fixed release - 23.2R2-S6, 23.4R2-S7, 24.2R2-S4, 24.4R2-S4, or 25.2R2 (or later) per Juniper advisory JSA110079 (https://supportportal.juniper.net/JSA110079). Where immediate patching is not possible, reduce exposure by constraining the Layer-2 adjacency an attacker needs: because the trigger is an adjacent (same-broadcast-domain) packet, restrict which devices share the affected interfaces' broadcast domains and apply strict port security / VLAN segmentation on access-facing ports so untrusted hosts cannot inject the crafted frames. If operationally feasible and the features are not required, disabling MAP-T or the non-IP-over-IP (e.g. MPLS-over-GRE) forwarding paths removes the vulnerable code path, but this will break any services that depend on those encapsulations, so validate the traffic profile before making the change. No configuration workaround fully mitigates while those features remain in use, so patching is the definitive fix.
Denial-of-service in Juniper Networks Junos OS on MX Series (with SPC3) and SRX Series devices allows an unauthenticated
Remote denial of service in Juniper Networks Junos OS on MX Series (with SPC3) and SRX Series firewalls lets an unauthen
Privilege escalation in Juniper Networks Junos OS allows high-privileged local attackers to gain root access on Linux-ba
Denial-of-service in the Packet Forwarding Engine (PFE) of Juniper Junos OS on MX (with SPC3) and SRX-series firewalls l
Denial-of-service in Juniper Networks Junos OS on SRX Series devices lets an unauthenticated, network-based attacker exh
Denial-of-service in Juniper Networks Junos OS on EX Series switches (EX2300, EX3400, EX4000, EX4100, EX4400) lets a low
Denial-of-service in Juniper Junos OS on EX4100 and EX4400 Series switches allows an unauthenticated adjacent attacker t
Denial-of-service in Juniper Networks Junos OS on QFX10000 Series switches allows an unauthenticated, adjacent (Layer 2)
Out-of-bounds write in the Juniper Networks Junos OS http-gatekeeper (http-gk) process on SRX Series firewalls crashes t
Repeated IKE negotiation failures on Juniper Junos OS (MX with SPC3 and SRX Series) cause a peer index rollover that ass
Web filtering bypass on Juniper Networks Junos OS MX Series exposes downstream resources to unauthenticated network atta
Denial-of-service in Juniper Networks Junos OS and Junos OS Evolved on EX Series, QFX Series, and MX Series allows a loc
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today