CVE-2026-102053 - Vulnerability Details

- Junos OS and Junos OS Evolved: An EVPN-VXLAN memory leak causes denial of service when active-active multihoming is used

Description

An Improper Release of Memory Before Removing Last Reference vulnerability in the l2ald process of Juniper Networks Junos OS and Junos OS Evolved on QFX5K-family platforms allows a configured EVPN peer to cause a denial of service through memory exhaustion via EVPN-VXLAN active-active multihoming route processing.

Published: 2026-10-14

Score: 6.9 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The flaw is an improper release of memory before removing the last reference in the l2ald process of Junos OS and Junos OS Evolved on QFX5K-family platforms. This leads to a memory leak when an EVPN peer processes active‑active multihoming routes, eventually exhausting available memory and causing a service interruption.

Affected Systems

The vulnerability affects Juniper Networks Junos OS and Junos OS Evolved running on QFX5K-family platforms. All software releases from the listed series – including 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1 – and the corresponding Evolved releases are affected.

Risk and Exploitability

The CVSS score of 6.9 indicates a medium severity vulnerability, and the EPSS score is < 1%. The issue is not listed in the CISA KEV catalog. Exploitation requires a configured EVPN peer and the use of active‑active multihoming. An attacker in control of such a peer could trigger the memory leak and cause a denial of service on the affected router.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Juniper Networks

Junos OS

unaffected

Version	Status	Constraints
`0`	affected	< 23.2R2-S7.7
`23.4`	affected	< 23.4R2-S8.13
`24.2`	affected	< 24.2R2-S5.5
`24.4`	affected	< 24.4R2-S5
`25.2`	affected	< 25.2R2-S2
`25.4`	affected	< 25.4R1-S3
`26.2`	affected	< 26.2R1-S2

Juniper Networks

Junos OS Evolved

unaffected

Version	Status	Constraints
`0`	affected	< 23.2R2-S7.7-EVO
`23.4`	affected	< 23.4R2-S8.11-EVO
`24.2`	affected	< 24.2R2-S5.6-EVO
`24.4`	affected	< 24.4R2-S5-EVO
`25.2`	affected	< 25.2R2-S2-EVO
`25.4`	affected	< 25.4R1-S3-EVO
`26.2`	affected	< 26.2R1-S2-EVO
`23.4X100`	affected	—
`25.2X100`	affected	< 25.2X100-D35-EVO
`25.4X300`	affected	< 25.4X300-D40-EVO

No data.

Vendor Product Confidence Versions

Juniper Networks

Junos Os

100%

Version	Status	Scheme	Platform
`[0,23.2R2-S7.7)`	affected	generic	—
`[23.4,23.4R2-S8.13)`	affected	generic	—
`[24.2,24.2R2-S5.5)`	affected	generic	—
`[24.4,24.4R2-S5)`	affected	generic	—
`[25.2,25.2R2-S2)`	affected	generic	—
`[25.4,25.4R1-S3)`	affected	generic	—
`[26.2,26.2R1-S2)`	affected	generic	—

Juniper Networks

Junos Os Evolved

100%

Version	Status	Scheme	Platform
`[0,23.2R2-S7.7-EVO)`	affected	generic	—
`[23.4,23.4R2-S8.11-EVO)`	affected	generic	—
`[24.2,24.2R2-S5.6-EVO)`	affected	generic	—
`[24.4,24.4R2-S5-EVO)`	affected	generic	—
`[25.2,25.2R2-S2-EVO)`	affected	generic	—
`[25.4,25.4R1-S3-EVO)`	affected	generic	—
`[26.2,26.2R1-S2-EVO)`	affected	generic	—
`23.4X100`	affected	generic	—
`[25.2X100,25.2X100-D35-EVO)`	affected	generic	—
`[25.4X300,25.4X300-D40-EVO)`	affected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

Vendor Solution

The following software releases have been updated to resolve this specific issue: Junos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1, and all subsequent releases. Junos OS Evolved: 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO, and all subsequent releases. Note: For Junos OS releases 23.2, 23.4, and 24.2, and Junos OS Evolved releases 23.2-EVO, 23.4-EVO, and 24.2-EVO, specific respins have been referenced. Previously published versions of these releases have been rebuilt to resolve the security vulnerabilities identified in this advisory.

Vendor Workaround

There are no known workarounds for this issue.

OpenCVE Recommended Actions

Upgrade Junos OS or Junos OS Evolved to any of the releases listed in the official solution to eliminate the memory leak.
Enable automated monitoring of router memory usage and set alerts for abnormal growth patterns to detect early signs of exhaustion.
Perform regular vulnerability assessments focusing on EVPN‑VXLAN configuration and ensure no overly permissive routes or active‑active multihoming configurations are present.

Generated by OpenCVE AI on October 15, 2026 at 16:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00327.

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://supportportal.juniper.net/JSA112187

History

Sat, 17 Oct 2026 00:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Juniper Networks Juniper Networks junos Os Juniper Networks junos Os Evolved
Vendors & Products		Juniper Networks Juniper Networks junos Os Juniper Networks junos Os Evolved

Fri, 16 Oct 2026 17:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 14 Oct 2026 17:00:00 +0000

Type	Values Removed	Values Added
Description		An Improper Release of Memory Before Removing Last Reference vulnerability in the l2ald process of Juniper Networks Junos OS and Junos OS Evolved on QFX5K-family platforms allows a configured EVPN peer to cause a denial of service through memory exhaustion via EVPN-VXLAN active-active multihoming route processing.
Title		Junos OS and Junos OS Evolved: An EVPN-VXLAN memory leak causes denial of service when active-active multihoming is used
Weaknesses		CWE-401
References		https://supportportal.juniper.net/JSA112187
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}` cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/AU:Y/R:A/V:C/RE:M'}`

Subscriptions

Juniper Networks Junos Os Junos Os Evolved

MITRE

Status: PUBLISHED

Assigner: juniper

Published: 2026-10-14T16:54:15.022Z

Updated: 2026-10-16T16:37:09.850Z

Reserved: 2026-09-28T17:35:40.522Z

Link: CVE-2026-102053

Vulnrichment

Updated: 2026-10-16T16:37:04.951Z

NVD

Status : Awaiting Analysis

Published: 2026-10-14T17:18:00.273

Modified: 2026-10-16T17:17:09.797

Link: CVE-2026-102053

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-10-17T00:30:13Z

Weaknesses

CWE-401
Missing Release of Memory after Effective Lifetime

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Exploitation none

Automatable yes

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object