An improper release of memory before removing the last reference in the l2cpd process allows an attacker to trigger repeated memory allocation when LLDP fast receive processing is enabled. The resulting memory exhaustion leads to a denial of service that interrupts the device’s Layer 2 control plane and stops traffic forwarding.

Juniper Networks Junos OS and Junos OS Evolved. Vulnerable releases include Junos OS 23.2R2‑S7.7, 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1 and all subsequent releases; Junos OS Evolved 23.2R2‑S7.7‑EVO, 23.4R2‑S8.11‑EVO, 24.2R2‑S5.6‑EVO, 24.4R2‑S5‑EVO, 25.2R2‑S2‑EVO, 25.2X100‑D35‑EVO, 25.4R1‑S3‑EVO, 25.4R2‑EVO, 25.4X300‑D40‑EVO, 26.2R1‑S2‑EVO, 26.2R2‑EVO, 26.4R1‑EVO and all later releases.

The CVSS score of 7.1 indicates a medium‑to‑high severity. The EPSS score is below 1 %, implying a very low but non‑zero likelihood that the vulnerability is being actively exploited. The vulnerability is not listed in CISA KEV, so no confirmed widespread exploits are known. An attacker must be on the same broadcast domain and able to inject LLDP frames; the LLDP protocol does not provide authentication, so a local or adjacent attacker can exploit the flaw with minimal effort. Successful exploitation drains the l2cpd process memory until the control plane stops responding, causing a denial of service.