CVE-2026-102053: Junos OS and Junos OS Evolved: An EVPN-VXLAN memory leak causes denial of service when active-active multihoming is used
An Improper Release of Memory Before Removing Last Reference vulnerability in the l2ald process of Juniper Networks Junos OS and Junos OS Evolved on QFX5K-family platforms allows a configured EVPN peer to cause a denial of service through memory exhaustion via EVPN-VXLAN active-active multihoming route processing.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Juniper Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 23.2R2-S7.7-EVOPatch 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO, and all subsequent releases - Upgrade
Upgrade
Juniper Junos OSto a version that resolves this vulnerability.Fixed in 23.2R2-S7.7Patch 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1, and all subsequent releases
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service condition?
The issue affects Juniper Networks Junos OS and Junos OS Evolved on QFX5K-family platforms where EVPN-VXLAN active-active multihoming is used and an EVPN peer is configured.
What must an attacker be able to do to trigger the problem?
A configured EVPN peer can trigger the memory exhaustion condition through EVPN-VXLAN active-active multihoming route processing. The supplied vector indicates network reachability is sufficient and does not require privileges or user interaction.
What is the operational impact if exploitation succeeds?
Memory consumption in the l2ald process can be exhausted, resulting in denial of service. The provided impact information indicates availability impact only, with no stated confidentiality or integrity impact.