The Layer 2 Address Learning Daemon (l2ald) in Juniper Networks Junos OS and Junos OS Evolved suffers from a missing release of memory after its effective lifetime. When ESI routes churn in an EVPN‑MPLS environment, the daemon allocates memory but fails to free it, causing a memory leak that eventually drains system memory, forces the l2ald process to crash, and triggers a restart. The denial of service that results disrupts Layer‑2 learning and connectivity across the fabric. This flaw is a classic uninitialized memory usage weakness (CWE‑401).

The flaw affects Juniper Networks Junos OS and Junos OS Evolved. All releases before 22.4 R3‑S5, before 23.2 R2‑S3, before 23.4 R2‑S4, and before 24.2 R2 in Junos OS are impacted, as are the corresponding earlier releases in Junos OS Evolved (pre‑22.4 R3‑S5‑EVO, pre‑23.2 R2‑S3‑EVO, pre‑23.4 R2‑S4‑EVO, and pre‑24.2 R2‑EVO). Devices running any of these versions are vulnerable.

The risk rating for this issue is 7.1 on the Common Vulnerability Scoring System scale, indicating high severity. An adjacent attacker who can influence ESI route churn—without authentication or elevated privileges—can trigger the memory exhaustion and bring down the l2ald service. The vulnerability is not listed in the official known exploited vulnerabilities catalog, but the lack of a workaround means that the only reliable defense is to apply the vendor's updated releases. Because the condition requires only route churn in an EVPN‑MPLS environment, the exploitation surface is potentially broad in networks that use this configuration.