EUVD-2026-42715
GHSA-2xj6-hwhm-5m6g
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Resource cleanup, leak prevention
|
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jul 09, 2026
Denial-of-service in Juniper Junos OS on EX4100 and EX4400 Series switches allows an unauthenticated adjacent attacker to exhaust packet-forwarding-engine memory and crash the Flexible PIC Concentrator (FPC). The flaw triggers only when sFlow monitoring is enabled in a Virtual Chassis and multicast traffic ingresses on one VC member and egresses on another, causing a slow buffer leak that culminates in an FPC crash and restart. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a credible availability risk for affected deployments.
Earlier versions of this analysis (2)
Denial-of-service in Juniper Junos OS on EX4100 and EX4400 Series switches lets an unauthenticated adjacent attacker exhaust packet-forwarding-engine memory, crashing and restarting the FPC. The flaw (CWE-401 memory leak) is triggered only when sFlow is configured in a Virtual Chassis and multicast traffic ingresses on one VC member and egresses another. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a credible availability threat in affected deployments.
Memory leak in Juniper Networks Junos OS on EX4100 and EX4400 Series Virtual Chassis deployments allows unauthenticated adjacent attackers to crash the packet forwarding engine, causing a Denial-of-Service condition. When sFlow telemetry is active in a Virtual Chassis topology, multicast traffic traversing between VC members triggers progressive buffer accumulation in the PFE that ultimately results in an FPC crash and automatic restart. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV, but exploitation requires only Layer-2 adjacency and the ability to send multicast traffic.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Junos Os gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/RE:M
Adjacent L2 multicast trigger (AV:A), no auth or interaction (PR:N/UI:N), simple to trigger (AC:L), pure availability impact from FPC crash (A:H), no confidentiality/integrity effect.
Primary rating from Vendor (juniper).
CVSS VectorVendor: juniper
Lifecycle Timeline
5DescriptionCVE.org
A Missing Release of Memory after Effective Lifetime vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on specific EX Series devices allows an unauthenticated adjacent attacker to cause a Denial-of-Service (DoS).When sFlow is configured in a Virtual Chassis (VC) scenario with EX4100 Series or EX4400 Series devices, multicast traffic which is received on one VC member and sent out on another member leads to a memory leak and ultimately an FPC crash and restart.
The leak can be monitored by watching the continuous increase of the buffer values in the output of:
user@host> show chassis fpc This issue affects Junos OS on EX4100 Series and EX4400:
- all versions before 23.2R2-S7,
- 23.4 versions before 23.4R2-S7,
- 24.2 versions before 24.2R2-S4,
- 24.4 versions before 24.4R2.
Articles & Coverage 2
Executive ViewAI
Juniper Junos OS EX4100 and EX4400 Series switches are vulnerable to denial-of-service attacks that can cause network outages when sFlow monitoring is enabled in Virtual Chassis configurations. Organizations relying on these switches for network infrastructure should immediately assess their exposure, as the vulnerability requires only adjacent network access and affects packet-forwarding capacity.
Within 24 hours: Inventory all EX4100 and EX4400 switches in production and identify those with sFlow enabled in Virtual Chassis deployments. Within 7 days: For affected deployments, disable sFlow if not operationally critical, or reconfigure to prevent multicast traffic from ingressing on one Virtual Chassis member and egressing on another. Within 30 days: Monitor Juniper security advisories for a vendor-released patch and prepare deployment procedures; maintain vulnerability tracking until patch availability is confirmed.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable sFlow monitoring if network visibility through this tool is not operationally critical, (2) Redesign Virtual Chassis topology to prevent multicast traffic from crossing VC member boundaries, (3) Implement memory monitoring and alerts on FPC resources to detect early warning signs, (4) Evaluate hardware upgrade to models not affected by CVE-2026-57027 if sFlow is required and topology reconfiguration is infeasible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
OS command injection in the phcd phone-home daemon of Juniper Networks Junos OS and Junos OS Evolved lets an adjacent, u
Unauthenticated remote code execution with root privileges affects Juniper Networks Junos OS devices that expose the J-W
Heap-based buffer overflow in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allow
A stack-based buffer overflow in the srxpfe packet forwarding process of Juniper Networks Junos OS on SRX Series devices
Unauthenticated remote code execution with elevated privileges is possible in Juniper Junos OS and Junos OS Evolved thro
Remote root code execution in the routing protocol daemon (rpd) of Juniper Junos OS is reachable through protocol-valid
Remote code execution (on Junos OS) and rpd denial of service (on Junos OS and Junos OS Evolved) result from a stack-bas
Remote code execution with root privileges on Juniper Networks Junos OS and Junos OS Evolved is possible when the routin
Remote code execution and denial of service in Juniper Networks Junos OS and Junos OS Evolved arise from a stack-based b
Unauthenticated remote attackers can gain root-level configuration access and fully compromise Juniper Junos OS and Juno
Integer underflow in the Junos OS kernel can crash a device when the Extended Echo feature (RFC 8335 ICMP probing) is co
Heap-based buffer overflow in Juniper Networks Junos OS on SRX Series devices that have Secure Vector Routing (SVR) enab
Exploit-DB