p PatchFirst

CVE-2026-102054

CVE-2026-102054 · Junos OS and Junos OS Evolved: Insufficient validation of VXLAN overlay ping causes information disclosure when EVPN-VXLAN is configured

This page contains facts from public vulnerability sources. Check the original advisory before updating.

An Improper Handling of Length Parameter Inconsistency vulnerability in L2ALM of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to obtain stale PFE packet memory via VXLAN overlay-ping traffic sent to a local VTEP.

CVSS 5.3 · Medium · EPSS 0.2% · Fix available

Published
Updated

Affected products and versions

  • junos os

    Versions
    • ≥ 0, < 23.2R2-S7.7: Affected (custom)
    • ≥ 23.4, < 23.4R2-S8.13: Affected (custom)
    • ≥ 24.2, < 24.2R2-S5.5: Affected (custom)
    • ≥ 24.4, < 24.4R2-S5: Affected (custom)
    • ≥ 25.2, < 25.2R2-S2: Affected (custom)
    • ≥ 25.4, < 25.4R1-S3: Affected (custom)
    • ≥ 26.2, < 26.2R1-S2: Affected (custom)

    Update to 23.2R2-S7.7

  • junos os evolved

    Versions
    • ≥ 0, < 23.2R2-S7.7-EVO: Affected (custom)
    • ≥ 23.4, < 23.4R2-S8.11-EVO: Affected (custom)
    • ≥ 24.2, < 24.2R2-S5.6-EVO: Affected (custom)
    • ≥ 24.4, < 24.4R2-S5-EVO: Affected (custom)
    • ≥ 25.2, < 25.2R2-S2-EVO: Affected (custom)
    • ≥ 25.4, < 25.4R1-S3-EVO: Affected (custom)
    • ≥ 26.2, < 26.2R1-S2-EVO: Affected (custom)
    • 23.4X100: Affected (custom)
    • ≥ 25.2X100, < 25.2X100-D35-EVO: Affected (custom)
    • ≥ 25.4X300, < 25.4X300-D40-EVO: Affected (custom)

    Update to 23.2R2-S7.7-EVO; Update to 24.2R2-S5.6-EVO

Original sources

Check your server →