An integer overflow or wraparound condition in the l2ald process of Juniper Networks Junos OS and Junos OS Evolved allows a configured EVPN BGP peer to cause a denial of service by repeatedly injecting EVPN Type‑2 MAC/IP routes. The overflow occurs during route processing, resulting in a crash of the l2ald service and loss of Layer‑2 forwarding until the service is restarted. The weakness is a classic integer overflow (CWE‑190) that directly compromises service availability.

The affected products are Juniper Networks Junos OS and Junos OS Evolved. Software releases that contain the fix include all variants from Junos OS 23.2R2‑S7.7 onward and all subsequent releases, and from Junos OS Evolved 23.2R2‑S7.7‑EVO onward and all subsequent releases. Any earlier releases remain vulnerable.

The CVSS base score is 8.7, indicating high severity. EPSS information is not available. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves a malicious or compromised EVPN BGP peer that injects carefully crafted Type‑2 routes; the attacker would need egress control of a BGP peer or the ability to tamper with EVPN routing advertisements. Once triggered, the l2ald process crashes, resulting in a denial of service for all Layer‑2 traffic on the affected device. The risk is significant for organizations that rely on EVPN for their overlay networks, as a single vulnerable peer can exhaust service availability.