p PatchFirst

CVE-2026-102053

CVE-2026-102053 · Junos OS and Junos OS Evolved: An EVPN-VXLAN memory leak causes denial of service when active-active multihoming is used

This page contains facts from public vulnerability sources. Check the original advisory before updating.

An Improper Release of Memory Before Removing Last Reference vulnerability in the l2ald process of Juniper Networks Junos OS and Junos OS Evolved on QFX5K-family platforms allows a configured EVPN peer to cause a denial of service through memory exhaustion via EVPN-VXLAN active-active multihoming route processing.

CVSS 6.9 · Medium · EPSS 0.3% · Fix available

Published
Updated

Affected products and versions

  • junos os

    Versions
    • ≥ 0, < 23.2R2-S7.7: Affected (custom)
    • ≥ 23.4, < 23.4R2-S8.13: Affected (custom)
    • ≥ 24.2, < 24.2R2-S5.5: Affected (custom)
    • ≥ 24.4, < 24.4R2-S5: Affected (custom)
    • ≥ 25.2, < 25.2R2-S2: Affected (custom)
    • ≥ 25.4, < 25.4R1-S3: Affected (custom)
    • ≥ 26.2, < 26.2R1-S2: Affected (custom)

    Update to 23.2R2-S7.7

  • junos os evolved

    Versions
    • ≥ 0, < 23.2R2-S7.7-EVO: Affected (custom)
    • ≥ 23.4, < 23.4R2-S8.11-EVO: Affected (custom)
    • ≥ 24.2, < 24.2R2-S5.6-EVO: Affected (custom)
    • ≥ 24.4, < 24.4R2-S5-EVO: Affected (custom)
    • ≥ 25.2, < 25.2R2-S2-EVO: Affected (custom)
    • ≥ 25.4, < 25.4R1-S3-EVO: Affected (custom)
    • ≥ 26.2, < 26.2R1-S2-EVO: Affected (custom)
    • 23.4X100: Affected (custom)
    • ≥ 25.2X100, < 25.2X100-D35-EVO: Affected (custom)
    • ≥ 25.4X300, < 25.4X300-D40-EVO: Affected (custom)

    Update to 23.2R2-S7.7-EVO; Update to 24.2R2-S5.6-EVO

Original sources

Check your server →