EUVD-2026-42707
GHSA-vhf9-x75x-qgv5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain Layer 2 adjacency in EVPN-VxLAN fabric
-
DeliveryCraft IPv6 multicast packets
-
ExploitSend to spine non-IRB interface
-
ExecutionPFE floods to spines and ESI leaves
-
PersistEndless forwarding loop saturates links
-
ImpactLegitimate traffic denied
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Unusual condition handling
|
| Exploitation Conditions | Exploitation requires a QFX10000 Series switch running an affected Junos OS release and deployed in an EVPN-VxLAN scenario. The attacker must have adjacent (Layer 2, AV:A) network access such that crafted IPv6 multicast packets can reach a NON-IRB interface of a spine switch - that specific interface-type and traffic-type combination is the trigger. No authentication (PR:N) and no user interaction (UI:N) are needed once adjacency exists. Limiting factors: the attacker cannot exploit this remotely across Layer 3 (must be adjacent within the fabric), the topology must use EVPN-VxLAN with a spine/ESI-leaf design, and only the QFX10000 Series on the listed vulnerable versions is affected - devices on Junos releases after 24.4 do not run on this hardware and are out of scope. |
| Impact | The vendor CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L, score 7.1) describes a pure availability impact with no confidentiality or integrity loss, reachable without authentication or user interaction but only from an adjacent network position - the attacker must already have Layer 2 reachability to a spine's non-IRB interface inside the EVPN-VxLAN fabric. Low attack complexity and no privileges make it trivially exploitable once that adjacency exists, but the adjacency requirement plus the need for an EVPN-VxLAN spine topology sharply limits the realistic attacker population to those with a foothold in the data-center fabric. No EPSS score, SSVC decision, POC, or KEV entry was provided, so there is no evidence of active or automatable exploitation; this reads as a high-impact-but-access-constrained availability bug rather than an internet-facing emergency. Note a data conflict: the intelligence tag labels this 'Information Disclosure,' which contradicts both the description (DoS) and the CVSS vector (VC:N, VA:H) - the tag is inaccurate and this should be treated as a DoS/availability issue. |
| Exploit ScenarioDerived | An attacker with Layer 2 adjacency inside an EVPN-VxLAN data-center fabric (for example, from a compromised host, rogue leaf-connected device, or misconfigured port) sends crafted IPv6 multicast frames toward a non-IRB interface of a QFX10000 spine. The PFE floods the frames to peer spines and all ESI leaf switches and re-loops them endlessly, saturating fabric links and degrading or dropping legitimate traffic. No public proof-of-concept is known, but the low complexity and lack of authentication mean a positioned attacker could trigger it with simple packet-generation tooling. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jul 09, 2026
Denial-of-service in Juniper Networks Junos OS on QFX10000 Series switches allows an unauthenticated, adjacent (Layer 2) attacker to saturate data-center links by injecting IPv6 multicast traffic in an EVPN-VxLAN fabric. When such packets reach a non-IRB interface of a spine switch, the packet-forwarding engine floods them to other spines and all ESI leaf switches, creating an endless forwarding loop that starves legitimate traffic. No public exploit identified at time of analysis and it is not listed in CISA KEV; the vendor-assigned CVSS 4.0 base score is 7.1.
Earlier versions of this analysis (2)
Denial-of-service in the packet forwarding engine (pfe) of Juniper Junos OS on QFX10000 Series switches allows an unauthenticated, adjacent (Layer 2) attacker to saturate fabric links in EVPN-VxLAN deployments. By injecting IPv6 multicast traffic that reaches a non-IRB interface of a spine switch, the packet is flooded to other spines and all ESI leaf switches and forwarded in an endless loop, starving legitimate traffic. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Denial-of-service in Juniper Networks Junos OS on QFX10000 Series spine switches allows an unauthenticated, adjacent attacker to create an infinite packet forwarding loop by sending IPv6 multicast traffic to a non-IRB interface in an EVPN-VxLAN topology, saturating network links and disrupting legitimate traffic. The flaw exists in the packet forwarding engine (PFE), which fails to properly handle this unusual forwarding condition (CWE-754) - instead flooding the packet to other spines and all Ethernet Segment Identifier leaf switches indefinitely. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis, but the adjacent-network attack vector with no authentication requirement lowers the barrier for insiders or attackers with physical or L2 segment access.
RemediationAI
Upgrade Junos OS on QFX10000 Series to a fixed release: 23.2R2-S7 or later, 23.4R2-S8 or later, 24.2R2-S4 or later, or 24.4R2-S4 or later, per Juniper advisory JSA110080 (https://supportportal.juniper.net/JSA110080). Because the QFX10000 Series is end-of-support after 24.4, upgrade within one of these fixed maintenance releases rather than expecting a newer major version. As compensating controls where immediate patching is not possible, restrict or filter IPv6 multicast traffic reaching non-IRB interfaces of spine switches (for example, apply ingress firewall filters/ACLs that drop unexpected IPv6 multicast on those ports) and limit Layer 2 adjacency to trusted devices only - with the trade-off that overly broad multicast filtering can break legitimate IPv6 neighbor discovery, MLD, or multicast applications and should therefore be scoped narrowly to the affected non-IRB interfaces. Consult Juniper support for any vendor-recommended interim workaround, as none was specified in the advisory metadata provided.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the packet forwarding engine (PFE) of Junos OS running on QFX10000 Series spine/leaf data-center switches deployed in an EVPN-VxLAN overlay. EVPN-VxLAN uses IRB (Integrated Routing and Bridging) interfaces to route between VXLAN segments; the flaw arises when IPv6 multicast frames arrive on a non-IRB interface of a spine, where the PFE fails to properly handle this exceptional condition (CWE-754, Improper Check for Unusual or Exceptional Conditions). Instead of dropping or correctly constraining the multicast frame, the PFE re-floods it across spine-to-spine links and every Ethernet Segment Identifier (ESI) leaf, and because the flooding path re-injects the packet, it loops indefinitely. The single CPE published is cpe:2.3:a:juniper_networks:junos_os:*:*:*:*:*:*:*:*, which is generic and does not by itself encode the QFX10000 hardware constraint stated in the description.
Know when Junos Os gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:U/RE:M
Adjacent Layer 2 access needed (AV:A) with no auth or interaction (PR:N/UI:N); impact is pure availability from link saturation (A:H, C:N/I:N), no base scope change.
Primary rating from Vendor (juniper).
CVSS VectorVendor: juniper
Lifecycle Timeline
3DescriptionCVE.org
An Improper Check for Unusual or Exceptional Conditions vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on QFX10000 Series allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS).
On all QFX10000 platforms in an EVPN-VxLAN scenario, if an attacker sends IPv6 multicast traffic and these packets reach the non-IRB interface of a spine switch it floods the packet to other spines and all Ethernet Segment Identifier (ESI) leaf switches. This flooding causes the packet to be forwarded in a endless loop, which can lead to saturation of the involved links and in turn impact to legitimate traffic.
This issue affects Junos OS on QFX10000 Series:
- all versions before 23.2R2-S7,
- 23.4 versions before 23.4R2-S8,
- 24.2 versions before 24.2R2-S4,
- 24.4 versions before 24.4R2-S4.
This issue does not affect Junos version after 24.4 as the QFX10000 Series devices are not supported on newer versions anymore.
Articles & Coverage 1
Executive ViewAI
Juniper Networks Junos OS on QFX10000 Series data-center switches contains a denial-of-service vulnerability in EVPN-VxLAN fabric forwarding that allows Layer 2-adjacent attackers to create cascading packet loops starving legitimate traffic across spine and leaf switches. Organizations operating QFX10000 fabric infrastructure face potential data-center outages affecting all dependent services. No vendor-released patch identified at time of analysis, requiring interim mitigation controls.
Restrict Layer 2 access to fabric infrastructure via port security and VLAN segmentation to block untrusted adjacent devices; implement ingress IPv6 multicast filtering on spine and leaf non-IRB interfaces; deploy network telemetry and anomaly detection to identify forwarding loop traffic signatures; evaluate temporary network segmentation or isolation of critical QFX10000 fabric domains until patch becomes available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
OS command injection in the phcd phone-home daemon of Juniper Networks Junos OS and Junos OS Evolved lets an adjacent, u
Unauthenticated remote code execution with root privileges affects Juniper Networks Junos OS devices that expose the J-W
Heap-based buffer overflow in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allow
A stack-based buffer overflow in the srxpfe packet forwarding process of Juniper Networks Junos OS on SRX Series devices
Unauthenticated remote code execution with elevated privileges is possible in Juniper Junos OS and Junos OS Evolved thro
Remote root code execution in the routing protocol daemon (rpd) of Juniper Junos OS is reachable through protocol-valid
Remote code execution (on Junos OS) and rpd denial of service (on Junos OS and Junos OS Evolved) result from a stack-bas
Remote code execution with root privileges on Juniper Networks Junos OS and Junos OS Evolved is possible when the routin
Remote code execution and denial of service in Juniper Networks Junos OS and Junos OS Evolved arise from a stack-based b
Unauthenticated remote attackers can gain root-level configuration access and fully compromise Juniper Junos OS and Juno
Integer underflow in the Junos OS kernel can crash a device when the Extended Echo feature (RFC 8335 ICMP probing) is co
Heap-based buffer overflow in Juniper Networks Junos OS on SRX Series devices that have Secure Vector Routing (SVR) enab
Exploit-DB