Junos OS EUVD-2026-101377

Exploitation requires the target to be a QFX5K-family device running Junos OS or Junos OS Evolved with EVPN-VXLAN active-active multihoming configured, AND the attacker to be (or control) a device that is already a configured EVPN peer of that target - the memory leak is triggered specifically during active-active multihoming route processing in the l2ald process. Limiting factors: this is not reachable against default or non-EVPN configurations; the attacker cannot be an arbitrary unauthenticated internet host but must hold an established EVPN peering/trust relationship within the fabric, which materially constrains who can exploit it despite the CVSS PR:N rating. Impact is confined to availability (process/device DoS via memory exhaustion); there is no data disclosure or modification. A vendor patch is available, so patched versions listed in EUVD are not exploitable.

This is a medium-severity, availability-only denial-of-service issue (CWE-401 memory leak / improper release of memory), not a high-priority remote code execution threat. The vendor CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) scores 6.9 with impact limited to VA:L - a partial availability hit via memory exhaustion in the l2ald process, with no confidentiality or integrity impact (VC:N/VI:N). Exploitation status: no public exploit identified at time of analysis - the CVE is not in CISA KEV and no POC is referenced. No EPSS score was provided, so statistical exploitation probability cannot be assessed. The most important nuance is a conflict between the CVSS metric and the description: the vector sets PR:N (unauthenticated), but the description requires 'a configured EVPN peer,' meaning the attacker must already occupy a trusted peering relationship that the target operator deliberately configured - a significant real-world barrier that PR:N understates. The 4.0 vector's AU:Y (automatable/user-interaction-adjacent) and V:C (confirmed value) flags and vendor-sourced reporting are consistent with a genuine but gated bug. Net: a real, patch-worthy reliability defect for Juniper QFX5K EVPN-VXLAN fabrics, but closer to a low-to-moderate operational risk than an urgent internet-facing emergency, because exploitation is confined to already-peered EVPN participants.

An attacker who controls or has compromised a device that is already a configured EVPN peer in a QFX5K-family EVPN-VXLAN active-active multihoming fabric advertises specially crafted or repeated multihoming routes. The l2ald process fails to release memory while processing these routes, and sustained advertisement progressively exhausts memory until the process degrades or the device loses EVPN/L2 forwarding function. No public exploit code is known, and the attacker must already hold a valid EVPN peering relationship, so this is not opportunistic remote exploitation.