EUVD-2026-42718
GHSA-x7gh-cpmx-x9cj
Severity by source
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:M/U:X
Adjacent vector; AC:H because exploitation requires an uncontrollable race condition timing window; no privileges needed; high availability impact on the forwarding plane when triggered.
Primary rating from Vendor (juniper).
CVSS VectorVendor: juniper
Lifecycle Timeline
3DescriptionCVE.org
A Missing Synchronization vulnerability in the flow collector handler of Juniper Networks Junos OS Evolved on QFX Series allows an adjacent, unauthenticated attacker to cause a Denial-of-Service (DoS).
When the reachability of an sFlow collector changes, the corresponding next-hop entry is updated. If this update occurs simultaneously with the sFlow thread accessing the next-hop data (which is outside the attackers control), it causes the evo-pfemand process to crash, impacting all traffic forwarding until the automatic process restart has completed.
This issue affects Junos OS Evolved on QFX Series:
- all 23.2 versions,
- 23.4 versions before 23.4R2-S7-EVO,
- 24.2 versions before 24.2R2-S5-EVO,
- 24.4 versions before 24.4R2-S3-EVO,
- 25.2 versions before 25.2R2-EVO.
AnalysisAI
Traffic forwarding on Juniper QFX Series switches running Junos OS Evolved can be fully disrupted by an adjacent, unauthenticated attacker exploiting a race condition in the sFlow collector handler. When sFlow collector reachability changes trigger a next-hop entry update concurrently with the sFlow thread reading that same next-hop data, the evo-pfemand process crashes and all packet forwarding halts until the process automatically restarts. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis, but the availability impact is severe for any network segment relying on the affected switch.
Technical ContextAI
CWE-820 (Missing Synchronization) identifies a classic race condition: two concurrent execution threads access shared memory without adequate locking or atomic guarantees. In Junos OS Evolved on QFX Series, the sFlow flow collector handler maintains a reference to a next-hop entry used for exporting sampled traffic data. When the reachability of the configured sFlow collector changes - for example due to a routing update or link failure - the kernel updates the associated next-hop structure. If the sFlow processing thread dereferences this entry at the same instant the update is being written, the resulting memory inconsistency causes the evo-pfemand (Packet Forwarding Engine manager daemon) to crash. Because evo-pfemand is the central forwarding process on Junos OS Evolved, its crash interrupts all traffic forwarding on the device until automatic process recovery completes. The affected CPE is cpe:2.3:a:juniper_networks:junos_os_evolved across the 23.2, 23.4, 24.2, 24.4, and 25.2 release trains on QFX hardware. The CVSS 4.0 Attack Requirements metric AT:P correctly captures that this race window is probabilistic and not directly controllable by the attacker.
RemediationAI
Upgrade Junos OS Evolved on affected QFX Series devices to a fixed release: 23.4R2-S7-EVO or later in the 23.4 train, 24.2R2-S5-EVO or later in the 24.2 train, 24.4R2-S3-EVO or later in the 24.4 train, or 25.2R2-EVO or later in the 25.2 train. Devices running any 23.2 version should upgrade to a fixed train, as no fix is identified within 23.2. Consult Juniper advisory JSA110089 (https://supportportal.juniper.net/JSA110089) for the complete upgrade matrix. If immediate patching is not feasible, the primary compensating control is to disable sFlow sampling on the affected device, which eliminates the vulnerable code path entirely; the trade-off is loss of network flow telemetry. Alternatively, ensuring stable, reliable reachability to the configured sFlow collector reduces the frequency of next-hop update events that can trigger the race window, though this is not a complete mitigation. Restricting adjacency to the management plane via ACLs or VRF separation does not prevent exploitation since the attack vector is the data-plane adjacency of the device itself.
More in Junos Os Evolved
View allAn Improper Handling of Exceptional Conditions vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows an
An Exposure of Resource to Wrong Sphere vulnerability in the sampling service of Juniper Networks Junos OS Evolved allow
An improper check for unusual or exceptional conditions in Juniper Networks Junos OS and Junos OS Evolved Routing Protoc
A Missing Release of File Descriptor or Handle after Effective Lifetime vulnerability in plugable authentication module
An Unchecked Return Value vulnerability in the user interfaces to the Juniper Networks Junos OS and Junos OS Evolved, th
An OS Command Injection vulnerability in gRPC Network Operations Interface (gNOI) server module of Juniper Networks Juno
An Execution with Unnecessary Privileges vulnerability in Management Daemon (mgd) of Juniper Networks Junos OS Evolved a
An Out Of Bounds (OOB) access vulnerability in the handling of responses by a Juniper Agile License (JAL) Client in Juni
An Improper Privilege Management vulnerability in the gRPC framework, used by the Juniper Extension Toolkit (JET) API on
An improper input validation vulnerability in the Routing Protocol Daemon (RPD) service of Juniper Networks Junos OS all
A Buffer Access with Incorrect Length Value vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos
An Allocation of Resources Without Limits or Throttling vulnerability in the kernel of Juniper Networks Junos OS Evolved
Same weakness CWE-820 – Missing Synchronization
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today