An allocation‑of‑resources without limits vulnerability in the l2cpd process allows an unauthenticated attacker adjacent to the device to cause a denial of service by crashing the l2cpd process when the FNP feature is enabled on a VPLS routing instance that has VLAN‑VPLS encapsulation active. The resulting crash causes a restart of l2cpd, interrupting layer‑2 forwarding and potentially dropping traffic on affected interfaces. No user authentication is required to trigger the flaw; the attacker only needs connectivity to the local chassis or the network segment that shares the L2 interface.

Juniper Networks Junos OS on all platforms except the PTX Series and SRX Series. Affected releases include 23.2R2‑S7.7, 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1, and all subsequent releases.

The CVSS score of 7.1 indicates a high severity, while the EPSS score is not available, suggesting that the exploitation probability is not yet quantified. The vulnerability is not listed in the CISA KEV catalog, implying that there is no known active exploitation in the wild at the time of this analysis. Exploitation requires a local or adjacent presence in the same chassis or network segment and the ability to enable FNP on a VPLS interface. Because the flaw does not involve remote code execution or privilege escalation, the immediate risk is the disruption of layer‑2 traffic due to l2cpd crashes, which can affect network availability for all services relying on the affected interfaces.