An Improper Handling of Length Parameter Inconsistency in the L2ALM component of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to capture stale packet filter engine memory via VXLAN overlay‑ping traffic sent to a local virtual tunnel endpoint. The flaw can reveal fragments of previous packet data, resulting in potential leakage of sensitive information and undermining confidentiality. The CVSS score of 5.3 reflects a moderate severity for information disclosure. The vulnerability does not provide a path to code execution or denial of service, but it can expose data that could be useful in a broader compromise. The attack requires the target to have EVPN‑VXLAN configured and proximity to the endpoint; no authentication is needed.

Juniper Networks products affected are Junos OS and Junos OS Evolved. For Junos OS, all releases listed—23.2R2‑S7.7, 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1, and any subsequent release—contain the flaw. For Junos OS Evolved, the vulnerable releases include 23.2R2‑S7.7‑EVO, 23.4R2‑S8.11‑EVO, 24.2R2‑S5.6‑EVO, 24.4R2‑S5‑EVO, 25.2R2‑S2‑EVO, 25.2X100‑D35‑EVO, 25.4R1‑S3‑EVO, 25.4R2‑EVO, 25.4X300‑D40‑EVO, 26.2R1‑S2‑EVO, 26.2R2‑EVO, 26.4R1‑EVO, and all later releases.

The flaw is rated moderate (CVSS 5.3) and its exploitation probability is 0.00222 (less than 1%), indicating a low but non‑zero risk. It is not listed in the CISA KEV catalog, meaning no widespread known exploits have been reported yet. The attack path requires an adjacent device that can send VXLAN overlay‑ping frames to the victim’s VTEP; no authentication barrier exists, but the attacker must be on the same physical or logical segment and the target system must be configured with EVPN‑VXLAN. Although the potential impact is limited to information disclosure, the lack of authentication makes the vulnerability easy to trigger from any node on the same segment, increasing the overall threat if the environment is unsegmented.