CVE-2026-33781: Junos OS: EX Series, QFX Series: In a VXLAN scenario when specific control protocol packets are received, memory leaks and eventually no traffic is passed
An Improper Check for Unusual or Exceptional Conditions vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on specific EX and QFX Series devices allow an unauthenticated, adjacent attacker to cause a complete Denial of Service (DoS).
On EX4k, and QFX5k platforms configured as service-provider edge devices, if L2PT is enabled on the UNI and VSTP is enabled on NNI in VXLAN scenarios, receiving VSTP BPDUs on UNI leads to packet buffer allocation failures, resulting in the device to not pass traffic anymore until it is manually recovered with a restart.This issue affects Junos OS:
24.4 releases before 24.4R2, 25.2 releases before 25.2R1-S1, 25.2R2.
This issue does not affect Junos OS releases before 24.4R1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Juniper Networks Junos OSto a version that resolves this vulnerability.Fixed in 24.4R2 - Upgrade
Upgrade
Juniper Networks Junos OSto a version that resolves this vulnerability.Fixed in 25.2R1-S1 - Upgrade
Upgrade
Juniper Networks Junos OSto a version that resolves this vulnerability.Fixed in 25.2R2 - Upgrade
Upgrade
Juniper Networks Junos OSto a version that resolves this vulnerability.Fixed in 25.4R1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33781?
CVE-2026-33781 is considered a medium severity vulnerability due to potential memory leaks affecting network traffic.
How do I fix CVE-2026-33781?
To address CVE-2026-33781, upgrade Junos OS to a version higher than 25.2R2 or apply the latest patches provided by Juniper.
What products are affected by CVE-2026-33781?
CVE-2026-33781 affects Juniper Networks Junos OS on EX Series and QFX Series devices running specific vulnerable versions.
What are the consequences of CVE-2026-33781?
CVE-2026-33781 can lead to memory leaks that hinder packet forwarding, ultimately resulting in no traffic being passed.
How can I determine if my device is impacted by CVE-2026-33781?
Check your Junos OS version against the affected versions listed in CVE-2026-33781 to confirm if your device is impacted.