IT SBIT Services
Schneeberger
DEEN
CVE tracker

Junos OS: Denial of service via EVPN Type-2 routes in l2ald

CVE-2026-102036High 8.7

← All vulnerabilities

Summary

An integer overflow in the l2ald process of Junos OS and Junos OS Evolved can be triggered by a configured EVPN BGP peer sending crafted EVPN Type-2 MAC/IP routes. Successful exploitation can cause a denial of service on the affected device. The attacker must already be a configured EVPN BGP peer, so the flaw is not directly reachable from the internet. The CVSS 4.0 base score is 8.7 (High), but no exploitation is known.

Affected

  • Junos OS: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; 26.2 before 26.2R1-S2
  • Junos OS Evolved: before 23.2R2-S7.7-EVO; 23.4 before 23.4R2-S8.11-EVO; 24.2 before 24.2R2-S5.6-EVO; 24.4 before 24.4R2-S5-EVO; 25.2 before 25.2R2-S2-EVO; 25.4 before 25.4R1-S3-EVO; 26.2 before 26.2R1-S2-EVO; 23.4X100; 25.2X100 before 25.2X100-D35-EVO; 25.4X300 before 25.4X300-D40-EVO
  • Default configuration: unaffected
  • Version details taken from the CVE record; verify against the vendor advisory.

Fixed in

  • Junos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1 and later
  • Junos OS Evolved: 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO and later
  • Respins exist for 23.2, 23.4 and 24.2; previously published builds of these releases were rebuilt.
  • Unknown: the exact fixed release for the 23.4X100 branch was not confirmed in the sources.

Workaround

Unknown. No workaround is documented in the CVE record; the advisory's workaround section could not be retrieved.

Exploitation

  • Juniper SIRT is not aware of any malicious exploitation.
  • CISA SSVC: exploitation none, automatable yes, technical impact partial.
  • No public proof of concept found at the time of the source data.

Our recommendation

  • Check whether EVPN is configured on your Junos OS and Junos OS Evolved devices (for example with show configuration protocols bgp and EVPN families).
  • If EVPN is used, plan the upgrade to a fixed release listed in JSA112187, starting with devices that peer with partners or providers.
  • Restrict EVPN BGP peers to known neighbours and keep BGP sessions authenticated.
  • Review the other CVEs in the same Juniper bulletin, which may be fixed by the same upgrade.
  • Monitor the vendor advisory for updates to the exploitation status.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 03:17.

Original description (NVD)

An Integer Overflow or Wraparound vulnerability in the l2ald process of Juniper Networks Junos OS and Junos OS Evolved allows a configured EVPN BGP peer to cause a denial of service via EVPN Type-2 MAC/IP routes.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed