CVE-2026-102053

Awaiting Analysis Awaiting Analysis - Queue

Improper Memory Release in Juniper Junos OS QFX5K EVPN

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: Juniper Networks, Inc.

Description

An Improper Release of Memory Before Removing Last Reference vulnerability in the l2ald process of Juniper Networks Junos OS and Junos OS Evolved on QFX5K-family platforms allows a configured EVPN peer to cause a denial of service through memory exhaustion via EVPN-VXLAN active-active multihoming route processing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-102053

EUVD

EUVD-2026-101377

Affected Vendors & Products

Vendor	Product	Version / Range
Juniper	Networks	Junos OS 0
Juniper	Networks	Junos OS 23.4
Juniper	Networks	Junos OS 24.2
Juniper	Networks	Junos OS 24.4
Juniper	Networks	Junos OS 25.2
Juniper	Networks	Junos OS 25.4
Juniper	Networks	Junos OS 26.2
Juniper	Networks	Junos OS Evolved 0
Juniper	Networks	Junos OS Evolved 23.4
Juniper	Networks	Junos OS Evolved 24.2
Juniper	Networks	Junos OS Evolved 24.4
Juniper	Networks	Junos OS Evolved 25.2
Juniper	Networks	Junos OS Evolved 25.4
Juniper	Networks	Junos OS Evolved 26.2
Juniper	Networks	Junos OS Evolved 23.4X100
Juniper	Networks	Junos OS Evolved 25.2X100
Juniper	Networks	Junos OS Evolved 25.4X300

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-401	The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

Executive Summary

This vulnerability is an Improper Release of Memory Before Removing Last Reference issue in the l2ald process of Juniper Networks Junos OS and Junos OS Evolved on QFX5K-family platforms. It allows a configured EVPN peer to cause a denial of service by triggering memory exhaustion through EVPN-VXLAN active-active multihoming route processing.

Detection Guidance

Detecting this vulnerability requires monitoring memory usage and EVPN-VXLAN route processing on QFX5K-family devices running Junos OS or Junos OS Evolved. Check for abnormal memory consumption in the l2ald process using commands like 'show system processes extensive' or 'show system memory'. Monitor EVPN-VXLAN active-active multihoming routes with 'show evpn instance' and 'show route extensive'. Look for excessive route churn or memory leaks.

Impact Analysis

This vulnerability can lead to a denial of service due to memory exhaustion, which may cause network devices to become unresponsive or crash. It specifically affects systems using EVPN-VXLAN active-active multihoming on QFX5K-family platforms.

Compliance Impact

This vulnerability causes a denial of service through memory exhaustion, which could disrupt network services. Such disruptions may impact systems handling sensitive data, potentially violating compliance requirements for availability in standards like GDPR and HIPAA.

Mitigation Strategies

Apply the latest Junos OS or Junos OS Evolved updates from Juniper Networks to patch the l2ald process vulnerability. Disable EVPN-VXLAN active-active multihoming route processing if not required. Monitor system memory usage for signs of exhaustion.

Hi! I’m here to help you understand CVE-2026-102053. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70