EUVD-2026-42707
GHSA-vhf9-x75x-qgv5
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:M/U:X
Adjacent Layer 2 access needed (AV:A) with no auth or interaction (PR:N/UI:N); impact is pure availability from link saturation (A:H, C:N/I:N), no base scope change.
Primary rating from Vendor (juniper).
CVSS VectorVendor: juniper
Lifecycle Timeline
7DescriptionCVE.org
An Improper Check for Unusual or Exceptional Conditions vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on QFX10000 Series allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS).
On all QFX10000 platforms in an EVPN-VxLAN scenario, if an attacker sends IPv6 multicast traffic and these packets reach the non-IRB interface of a spine switch it floods the packet to other spines and all Ethernet Segment Identifier (ESI) leaf switches. This flooding causes the packet to be forwarded in a endless loop, which can lead to saturation of the involved links and in turn impact to legitimate traffic.
This issue affects Junos OS on QFX10000 Series:
- all versions before 23.2R2-S7,
- 23.4 versions before 23.4R2-S8,
- 24.2 versions before 24.2R2-S4,
- 24.4 versions before 24.4R2-S4.
This issue does not affect Junos version after 24.4 as the QFX10000 Series devices are not supported on newer versions anymore.
Articles & Coverage 1
AnalysisAI
Denial-of-service in Juniper Networks Junos OS on QFX10000 Series switches allows an unauthenticated, adjacent (Layer 2) attacker to saturate data-center links by injecting IPv6 multicast traffic in an EVPN-VxLAN fabric. When such packets reach a non-IRB interface of a spine switch, the packet-forwarding engine floods them to other spines and all ESI leaf switches, creating an endless forwarding loop that starves legitimate traffic. No public exploit identified at time of analysis and it is not listed in CISA KEV; the vendor-assigned CVSS 4.0 base score is 7.1.
Technical ContextAI
The affected component is the packet forwarding engine (PFE) of Junos OS running on QFX10000 Series spine/leaf data-center switches deployed in an EVPN-VxLAN overlay. EVPN-VxLAN uses IRB (Integrated Routing and Bridging) interfaces to route between VXLAN segments; the flaw arises when IPv6 multicast frames arrive on a non-IRB interface of a spine, where the PFE fails to properly handle this exceptional condition (CWE-754, Improper Check for Unusual or Exceptional Conditions). Instead of dropping or correctly constraining the multicast frame, the PFE re-floods it across spine-to-spine links and every Ethernet Segment Identifier (ESI) leaf, and because the flooding path re-injects the packet, it loops indefinitely. The single CPE published is cpe:2.3:a:juniper_networks:junos_os:*:*:*:*:*:*:*:*, which is generic and does not by itself encode the QFX10000 hardware constraint stated in the description.
RemediationAI
Upgrade Junos OS on QFX10000 Series to a fixed release: 23.2R2-S7 or later, 23.4R2-S8 or later, 24.2R2-S4 or later, or 24.4R2-S4 or later, per Juniper advisory JSA110080 (https://supportportal.juniper.net/JSA110080). Because the QFX10000 Series is end-of-support after 24.4, upgrade within one of these fixed maintenance releases rather than expecting a newer major version. As compensating controls where immediate patching is not possible, restrict or filter IPv6 multicast traffic reaching non-IRB interfaces of spine switches (for example, apply ingress firewall filters/ACLs that drop unexpected IPv6 multicast on those ports) and limit Layer 2 adjacency to trusted devices only - with the trade-off that overly broad multicast filtering can break legitimate IPv6 neighbor discovery, MLD, or multicast applications and should therefore be scoped narrowly to the affected non-IRB interfaces. Consult Juniper support for any vendor-recommended interim workaround, as none was specified in the advisory metadata provided.
Denial-of-service in Juniper Networks Junos OS on MX Series (with SPC3) and SRX Series devices allows an unauthenticated
Remote denial of service in Juniper Networks Junos OS on MX Series (with SPC3) and SRX Series firewalls lets an unauthen
Privilege escalation in Juniper Networks Junos OS allows high-privileged local attackers to gain root access on Linux-ba
Denial-of-service in the Packet Forwarding Engine (PFE) of Juniper Junos OS on MX (with SPC3) and SRX-series firewalls l
Denial-of-service in Juniper Networks Junos OS on SRX Series devices lets an unauthenticated, network-based attacker exh
Denial-of-service in Juniper Networks Junos OS on EX Series switches (EX2300, EX3400, EX4000, EX4100, EX4400) lets a low
Denial-of-service in Juniper Junos OS on EX4100 and EX4400 Series switches allows an unauthenticated adjacent attacker t
Denial-of-service in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series routers lets an unauth
Out-of-bounds write in the Juniper Networks Junos OS http-gatekeeper (http-gk) process on SRX Series firewalls crashes t
Repeated IKE negotiation failures on Juniper Junos OS (MX with SPC3 and SRX Series) cause a peer index rollover that ass
Web filtering bypass on Juniper Networks Junos OS MX Series exposes downstream resources to unauthenticated network atta
Denial-of-service in Juniper Networks Junos OS and Junos OS Evolved on EX Series, QFX Series, and MX Series allows a loc
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today