CVE-2026-57027: Junos OS: EX4100 Series, EX4400: With sFlow configured in a VC scenario multicast traffic leads to an FPC crash
A Missing Release of Memory after Effective Lifetime vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on specific EX Series devices allows an unauthenticated adjacent attacker to cause a Denial-of-Service (DoS).When sFlow is configured in a Virtual Chassis (VC) scenario with EX4100 Series or EX4400 Series devices, multicast traffic which is received on one VC member and sent out on another member leads to a memory leak and ultimately an FPC crash and restart.
The leak can be monitored by watching the continuous increase of the buffer values in the output of:
user@host> show chassis fpc This issue affects Junos OS on EX4100 Series and EX4400:
all versions before 23.2R2-S7, 23.4 versions before 23.4R2-S7, 24.2 versions before 24.2R2-S4, 24.4 versions before 24.4R2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Juniper Networks Junos OS (packet forwarding engine - pfe) on EX Seriesto a version that resolves this vulnerability.Fixed in 23.2R2-S7 - Upgrade
Upgrade
Juniper Networks Junos OS (packet forwarding engine - pfe) on EX Seriesto a version that resolves this vulnerability.Fixed in 23.4R2-S7 - Upgrade
Upgrade
Juniper Networks Junos OS (packet forwarding engine - pfe) on EX Seriesto a version that resolves this vulnerability.Fixed in 24.2R2-S4 - Upgrade
Upgrade
Juniper Networks Junos OS (packet forwarding engine - pfe) on EX Seriesto a version that resolves this vulnerability.Fixed in 24.4R2 - Upgrade
Upgrade
Juniper Networks Junos OS (packet forwarding engine - pfe) on EX Seriesto a version that resolves this vulnerability.Fixed in 25.2R1 - Compensating control
On EX4100 Series and EX4400 in a Virtual Chassis (VC) scenario with sFlow configured, avoid/mitigate multicast traffic being received on one VC member and forwarded out another VC member (this traffic pattern can lead to a memory leak, FPC crash, and restart).
- Operational
Monitor the leak by continuously checking for increasing buffer values using the command shown in the material: 'show chassis fpc'.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-57027?
The severity of CVE-2026-57027 is classified as high with a score of 7.1.
How do I fix CVE-2026-57027?
To fix CVE-2026-57027, apply the latest patches and updates provided by Juniper Networks for affected Junos OS versions.
What devices are affected by CVE-2026-57027?
CVE-2026-57027 affects the Juniper Networks EX4100 Series and EX4400 Series devices.
What type of vulnerability is CVE-2026-57027?
CVE-2026-57027 is a Missing Release of Memory after Effective Lifetime vulnerability in the packet forwarding engine.
What impact does CVE-2026-57027 have on affected devices?
CVE-2026-57027 can lead to a Denial-of-Service (DoS) condition if exploited.