Which versions of Junos Os Evolved are affected by EUVD-2026-21090?

CVE-2026-33780 affects Juniper Networks Junos OS and Junos OS Evolved, enabling unauthenticated adjacent network attackers to crash Layer 2 services via resource exhaustion in the l2ald daemon,…. A patch is available.

How to fix or mitigate EUVD-2026-21090?

Within 24 hours: Identify all Juniper devices running affected Junos OS versions in your EVPN-MPLS network topology and document current OS versions. Within 7 days: Test vendor-released patch in a staging environment matching your production Layer 2 configuration, particularly multi-homed PE devices. Within 30 days: Deploy patched Junos OS versions to all affected production devices, prioritizing multi-homed Provider Edge systems, with change windows scheduled to minimize Layer 2 service interruption.

Junos Os Evolved EUVD-2026-21090

Q: What is the CVSS score of EUVD-2026-21090?

EUVD-2026-21090 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:M/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-33780 HIGH

Memory Leak (CWE-401)

2026-04-09 juniper

GHSA-wcmx-9w9j-q7ph

Denial Of Service Juniper Junos Os Evolved Junos Os Juniper Networks

7.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:M/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 18:07 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 05:59 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

23.2R2-S3,22.4R3-S5-EVO,24.2R2-EVO

EUVD ID Assigned

Apr 09, 2026 - 21:45 euvd

EUVD-2026-21090

Analysis Generated

Apr 09, 2026 - 21:45 vuln.today

CVE Published

Apr 09, 2026 - 21:29 nvd

HIGH 7.1

DescriptionCVE.org

A Missing Release of Memory after Effective Lifetime vulnerability in the Layer 2 Address Learning Daemon (l2ald) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated attacker to cause a memory leak ultimately leading to a Denial of Service (DoS).

In an EVPN-MPLS scenario, routes learned from remote multi-homed Provider Edge (PE) devices are programmed as ESI routes. Due to a logic issue in the l2ald memory management, memory allocated for these routes is not released when there is churn for these routes. As a result, memory leaks in the l2ald process which will ultimately lead to a crash and restart of l2ald.

Use the following command to monitor the memory consumption by l2ald:

user@device> show system process extensive | match "PID|l2ald"

This issue affects:

Junos OS:

all versions before 22.4R3-S5,
23.2 versions before 23.2R2-S3,
23.4 versions before 23.4R2-S4,
24.2 versions before 24.2R2;

Junos OS Evolved:

all versions before 22.4R3-S5-EVO,
23.2 versions before 23.2R2-S3-EVO,
23.4 versions before 23.4R2-S4-EVO,
24.2 versions before 24.2R2-EVO.

AnalysisAI

Memory leak in Juniper Networks l2ald daemon allows adjacent attackers to crash Layer 2 services on EVPN-MPLS networks. Affects Junos OS and Junos OS Evolved across multiple versions. Unauthenticated attackers on the same network segment can trigger resource exhaustion by causing ESI route churn from multi-homed Provider Edge devices, forcing l2ald process crash and restart. No public exploit identified at time of analysis, but exploitation requires only network adjacency without authentication.

Technical ContextAI

CWE-401 memory management flaw in l2ald daemon fails to release allocated memory for ESI routes learned from remote multi-homed PE devices in EVPN-MPLS topologies. Route churn triggers cumulative memory allocation without corresponding deallocation, causing unbounded resource consumption. CVSS:4.0 adjacency vector (AV:A) with no privilege requirement (PR:N) indicates local network exploitation.

RemediationAI

Vendor-released patches: Junos OS 22.4R3-S5, 23.2R2-S3, 23.4R2-S4, 24.2R2 or later. Junos OS Evolved 22.4R3-S5-EVO, 23.2R2-S3-EVO, 23.4R2-S4-EVO, 24.2R2-EVO or later. Prioritize deployment on systems running EVPN-MPLS configurations with multi-homed PE devices. Monitor l2ald memory consumption using 'show system process extensive | match PID|l2ald' as interim detection. No workaround exists; upgrade to patched releases is required. Official advisory: https://kb.juniper.net/JSA107819. Exploitation requires network adjacency; isolate management and control-plane networks where possible.