CVE-2026-102051

Awaiting Analysis Awaiting Analysis - Queue

Improper Memory Release in Juniper Junos OS l2cpd

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: Juniper Networks, Inc.

Description

An Improper Release of Memory Before Removing Last Reference vulnerability in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved platforms allows an adjacent unauthenticated attacker to cause l2cpd memory exhaustion and Layer 2 control-plane disruption via LLDP traffic when fast receive processing is enabled.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-102051

EUVD

EUVD-2026-101375

Affected Vendors & Products

Vendor	Product	Version / Range
Juniper	Networks	Junos OS 0
Juniper	Networks	Junos OS 23.4
Juniper	Networks	Junos OS 24.2
Juniper	Networks	Junos OS 24.4
Juniper	Networks	Junos OS 25.2
Juniper	Networks	Junos OS 25.4
Juniper	Networks	Junos OS 26.2
Juniper	Networks	Junos OS Evolved 0
Juniper	Networks	Junos OS Evolved 23.4
Juniper	Networks	Junos OS Evolved 24.2
Juniper	Networks	Junos OS Evolved 24.4
Juniper	Networks	Junos OS Evolved 25.2
Juniper	Networks	Junos OS Evolved 25.4
Juniper	Networks	Junos OS Evolved 26.2
Juniper	Networks	Junos OS Evolved 23.4X100
Juniper	Networks	Junos OS Evolved 25.2X100
Juniper	Networks	Junos OS Evolved 25.4X300

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-401	The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

Executive Summary

This vulnerability is an Improper Release of Memory Before Removing Last Reference issue in Juniper Networks Junos OS and Junos OS Evolved platforms. It affects the l2cpd process and allows an adjacent unauthenticated attacker to cause memory exhaustion in l2cpd and disrupt Layer 2 control-plane operations via LLDP traffic when fast receive processing is enabled.

Detection Guidance

Monitor l2cpd memory usage and LLDP traffic patterns. Check for excessive memory consumption in the l2cpd process using commands like 'show system processes extensive' or 'show system memory'. Look for unusual Layer 2 control-plane activity or disruptions in LLDP handling.

Impact Analysis

This vulnerability can lead to memory exhaustion in the l2cpd process, causing Layer 2 control-plane disruption. This may result in network instability, loss of connectivity, or degraded performance for affected Juniper devices running vulnerable Junos OS or Junos OS Evolved versions.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by disrupting Layer 2 control-plane operations, which may lead to network instability or downtime. Unauthorized memory exhaustion could affect data integrity and availability, key concerns for both regulations.

Mitigation Strategies

Disable fast receive processing for LLDP traffic if enabled. Apply Junos OS patches or updates from Juniper Networks. Restrict LLDP traffic to trusted adjacent networks. Monitor l2cpd memory usage closely after changes.

Hi! I’m here to help you understand CVE-2026-102051. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70