CVE-2026-102048

Awaiting Analysis Awaiting Analysis - Queue

Allocation of Resources Without Limits or Throttling in Juniper Networks Junos OS

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: Juniper Networks, Inc.

Description

An Allocation of Resources Without Limits or Throttling vulnerability in the l2cpd process of Juniper Networks Junos OS allows an adjacent unauthenticated attacker to cause a denial of service and l2cpd restart via FNP-enabled Layer 2 interfaces. The issue is triggered when the FNP feature is enabled on a VPLS routing instance with VLAN-VPLS encapsulation enabled. This issue affects all platforms except the PTX Series and SRX Series.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-102048

EUVD

EUVD-2026-101372

Affected Vendors & Products

Vendor	Product	Version / Range
Juniper	Networks	Junos OS 0
Juniper	Networks	Junos OS 23.4
Juniper	Networks	Junos OS 24.2
Juniper	Networks	Junos OS 24.4
Juniper	Networks	Junos OS 25.2
Juniper	Networks	Junos OS 25.4
Juniper	Networks	Junos OS 26.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This is an Allocation of Resources Without Limits or Throttling vulnerability in Juniper Networks Junos OS. It affects the l2cpd process and can be triggered when the FNP feature is enabled on a VPLS routing instance with VLAN-VPLS encapsulation. An adjacent unauthenticated attacker can exploit this to cause a denial of service and force the l2cpd process to restart.

Detection Guidance

Check if FNP is enabled on VPLS routing instances with VLAN-VPLS encapsulation using 'show configuration protocols l2cpd' and 'show configuration routing-instances'. Monitor l2cpd process crashes with 'show system processes extensive | match l2cpd' and system logs for related errors.

Impact Analysis

The vulnerability can lead to a denial of service, disrupting network services. It may cause the l2cpd process to restart, leading to temporary loss of Layer 2 control plane functionality. This impacts platforms except PTX and SRX Series.

Compliance Impact

This vulnerability causes a denial of service and l2cpd process restart, which could disrupt network services. Such disruptions may impact compliance with standards requiring high availability, like HIPAA for healthcare systems or GDPR for data processing continuity.

Mitigation Strategies

Disable FNP on affected VPLS routing instances with VLAN-VPLS encapsulation. Update Junos OS to a patched version if available. Apply rate limiting or throttling to FNP traffic if FNP must remain enabled. Restrict access to Layer 2 interfaces from untrusted sources.

Hi! I’m here to help you understand CVE-2026-102048. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70