CVE-2026-57019 (GCVE-0-2026-57019)

Vulnerability from cvelistv5 – Published: 2026-07-09 21:04 – Updated: 2026-07-10 13:29
VLAI
Title
Junos OS: MX Series: Specific traffic causes an FPC to reset
Summary
An Improper Validation of Specified Quantity in Input vulnerability in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS on MX Series allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS). When a specific packet is received from device in the same broadcast domain, an affected system calculates the packet size incorrectly. This causes further packet processing to fail, which triggers an FPC major error, resulting in a FPC reset impacting traffic until the FPC has automatically recovered. Affected scenarios are: MAP-T, or non-IP traffic encapsulated in IP (e.g. MPLS over GRE). When this issue happens the following logs can be observed: fpc<#> CMError: /fpc/0/pfe/0/cm/0/MQSS(0)/0/MQSS_CMERROR_LI_INT_REG_UNROLL_TAIL_LENGTH_OVF (0x2205eb), scope: pfe, category: functional, severity: major, module: MQSS(0), type: LI: Unroll TAIL length overflow, oc_category: default fpc<#> Performing action reset-fru for error /fpc/0/pfe/0/cm/0/MQSS(0)/0/MQSS_CMERROR_LI_INT_REG_UNROLL_TAIL_LENGTH_OVF (0x2205eb) in module: MQSS(0) with scope: pfe category: functional level: major, oc_category: default This issue affects Junos OS on MX Series: * all versions before 23.2R2-S6, * 23.4 versions before 23.4R2-S7, * 24.2 versions before 24.2R2-S4, * 24.4 versions before 24.4R2-S4, * 25.2 versions before 25.2R2.
Severity
6.5 (Medium)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
7.1 (High)
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/RE:M
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-10 13:29 UTC
CWE
  • CWE-1284 - Improper Validation of Specified Quantity in Input
Assigner
juniper CNA under the mitre root
CNA scorecard B 84/100 over 193 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Juniper Networks Junos OS Affected: 0 , < 23.2R2-S6 (custom)
Affected: 23.4 , < 23.4R2-S7 (custom)
Affected: 24.2 , < 24.2R2-S4 (custom)
Affected: 24.4 , < 24.4R2-S4 (custom)
Affected: 25.2 , < 25.2R2 (custom)
guessed Create a notification for this product.
Date Public
2026-07-08 16:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-57019",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-10T13:29:42.438982Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-10T13:29:55.755Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "MX Series"
          ],
          "product": "Junos OS",
          "vendor": "Juniper Networks",
          "versions": [
            {
              "lessThan": "23.2R2-S6",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "23.4R2-S7",
              "status": "affected",
              "version": "23.4",
              "versionType": "custom"
            },
            {
              "lessThan": "24.2R2-S4",
              "status": "affected",
              "version": "24.2",
              "versionType": "custom"
            },
            {
              "lessThan": "24.4R2-S4",
              "status": "affected",
              "version": "24.4",
              "versionType": "custom"
            },
            {
              "lessThan": "25.2R2",
              "status": "affected",
              "version": "25.2",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2026-07-08T16:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An Improper Validation of Specified Quantity in Input vulnerability in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS on MX Series allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS).\u003cbr\u003e\u003cp\u003e\n\nWhen a specific packet is received from device in the same broadcast domain, an affected system calculates the packet size incorrectly. This causes further packet processing to fail, which triggers an FPC major error, resulting in a FPC reset impacting traffic until the FPC has automatically recovered.\u003c/p\u003e\u003cp\u003eAffected scenarios are: MAP-T, or non-IP traffic encapsulated in IP (e.g. MPLS over GRE).\u003c/p\u003e\u003cp\u003eWhen this issue happens the following logs can be observed:\u003c/p\u003e\u003ctt\u003efpc\u0026lt;#\u0026gt; CMError: /fpc/0/pfe/0/cm/0/MQSS(0)/0/MQSS_CMERROR_LI_INT_REG_UNROLL_TAIL_LENGTH_OVF (0x2205eb), scope: pfe, category: functional, severity: major, module: MQSS(0), type: LI: Unroll TAIL length overflow, oc_category: default\u003cbr\u003e\u003c/tt\u003e\u003ctt\u003efpc\u0026lt;#\u0026gt; Performing action reset-fru for error /fpc/0/pfe/0/cm/0/MQSS(0)/0/MQSS_CMERROR_LI_INT_REG_UNROLL_TAIL_LENGTH_OVF (0x2205eb) in module: MQSS(0) with scope: pfe category: functional level: major, oc_category: default\u003c/tt\u003e\u003cp\u003e\n\n\u003cbr\u003e\u003c/p\u003e\u003cp\u003eThis issue affects Junos OS on MX Series:\u003cbr\u003e\u003c/p\u003e\u003cul\u003e\u003cli\u003eall versions before 23.2R2-S6,\u003c/li\u003e\u003cli\u003e23.4 versions before 23.4R2-S7,\u003c/li\u003e\u003cli\u003e24.2 versions before 24.2R2-S4,\u003c/li\u003e\u003cli\u003e24.4 versions before 24.4R2-S4,\u003c/li\u003e\u003cli\u003e25.2 versions before 25.2R2.\u003c/li\u003e\u003c/ul\u003e\u003cbr\u003e\u003cp\u003e\u003c/p\u003e"
            }
          ],
          "value": "An Improper Validation of Specified Quantity in Input vulnerability in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS on MX Series allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS).\n\n\nWhen a specific packet is received from device in the same broadcast domain, an affected system calculates the packet size incorrectly. This causes further packet processing to fail, which triggers an FPC major error, resulting in a FPC reset impacting traffic until the FPC has automatically recovered.\n\nAffected scenarios are: MAP-T, or non-IP traffic encapsulated in IP (e.g. MPLS over GRE).\n\nWhen this issue happens the following logs can be observed:\n\nfpc\u003c#\u003e CMError: /fpc/0/pfe/0/cm/0/MQSS(0)/0/MQSS_CMERROR_LI_INT_REG_UNROLL_TAIL_LENGTH_OVF (0x2205eb), scope: pfe, category: functional, severity: major, module: MQSS(0), type: LI: Unroll TAIL length overflow, oc_category: default\nfpc\u003c#\u003e Performing action reset-fru for error /fpc/0/pfe/0/cm/0/MQSS(0)/0/MQSS_CMERROR_LI_INT_REG_UNROLL_TAIL_LENGTH_OVF (0x2205eb) in module: MQSS(0) with scope: pfe category: functional level: major, oc_category: default\n\n\n\n\nThis issue affects Junos OS on MX Series:\n\n\n  *  all versions before 23.2R2-S6,\n  *  23.4 versions before 23.4R2-S7,\n  *  24.2 versions before 24.2R2-S4,\n  *  24.4 versions before 24.4R2-S4,\n  *  25.2 versions before 25.2R2."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."
            }
          ],
          "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "YES",
            "Recovery": "AUTOMATIC",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "ADJACENT",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/RE:M",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "MODERATE"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1284",
              "description": "CWE-1284 Improper Validation of Specified Quantity in Input",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-09T21:04:41.927Z",
        "orgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968",
        "shortName": "juniper"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://supportportal.juniper.net/JSA110079"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The following software releases have been updated to resolve this specific issue:\n\nJunos OS: 23.2R2-S6, 23.4R2-S7, 24.2R2-S4, 24.4R2-S4, 25.2R2, 25.4R1, and all subsequent releases."
            }
          ],
          "value": "The following software releases have been updated to resolve this specific issue:\n\nJunos OS: 23.2R2-S6, 23.4R2-S7, 24.2R2-S4, 24.4R2-S4, 25.2R2, 25.4R1, and all subsequent releases."
        }
      ],
      "source": {
        "advisory": "JSA110079",
        "defect": [
          "1912053"
        ],
        "discovery": "USER"
      },
      "title": "Junos OS: MX Series: Specific traffic causes an FPC to reset",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "There are no known workarounds for this issue."
            }
          ],
          "value": "There are no known workarounds for this issue."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968",
    "assignerShortName": "juniper",
    "cveId": "CVE-2026-57019",
    "datePublished": "2026-07-09T21:04:41.927Z",
    "dateReserved": "2026-06-23T16:27:00.248Z",
    "dateUpdated": "2026-07-10T13:29:55.755Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-57019",
      "date": "2026-10-30",
      "epss": "0.00269",
      "percentile": "0.19076"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "platforms": [
                  "MX Series"
                ],
                "product": "Junos OS",
                "vendor": "Juniper Networks",
                "versions": [
                  {
                    "lessThan": "23.2R2-S6",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "23.4R2-S7",
                    "status": "affected",
                    "version": "23.4",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "24.2R2-S4",
                    "status": "affected",
                    "version": "24.2",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "24.4R2-S4",
                    "status": "affected",
                    "version": "24.4",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "25.2R2",
                    "status": "affected",
                    "version": "25.2",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "sirt@juniper.net"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "3D14745F-3090-483F-9DB4-C424FA09BD21",
                    "versionEndExcluding": "23.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:23.2:-:*:*:*:*:*:*",
                    "matchCriteriaId": "1A78CC80-E8B1-4CDA-BB35-A61833657FA7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:23.2:r1:*:*:*:*:*:*",
                    "matchCriteriaId": "4B3B2FE1-C228-46BE-AC76-70C2687050AE",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:23.2:r1-s1:*:*:*:*:*:*",
                    "matchCriteriaId": "F1B16FF0-900F-4AEE-B670-A537139F6909",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:23.2:r1-s2:*:*:*:*:*:*",
                    "matchCriteriaId": "B227E831-30FF-4BE1-B8B2-31829A5610A6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:23.2:r2:*:*:*:*:*:*",
                    "matchCriteriaId": "1ADA814B-EF98-45B1-AF7A-0C89688F7CA5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:23.2:r2-s1:*:*:*:*:*:*",
                    "matchCriteriaId": "A6FB32DF-D062-4FB9-8777-452978BEC7B7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:23.2:r2-s2:*:*:*:*:*:*",
                    "matchCriteriaId": "B3B6C811-5C10-4486-849D-5559B592350A",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:23.2:r2-s3:*:*:*:*:*:*",
                    "matchCriteriaId": "078D61B9-A228-453C-9D20-6F9C6B20637F",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:23.2:r2-s4:*:*:*:*:*:*",
                    "matchCriteriaId": "F1F136A0-021D-43FE-BDD3-AD7201F7FC03",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:23.2:r2-s5:*:*:*:*:*:*",
                    "matchCriteriaId": "37147BC9-9ED8-48AE-906A-614AD8600962",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:23.4:-:*:*:*:*:*:*",
                    "matchCriteriaId": "78481ABC-3620-410D-BC78-334657E0BB75",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:23.4:r1:*:*:*:*:*:*",
                    "matchCriteriaId": "BE8A5BA3-87BD-473A-B229-2AAB2C797005",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:23.4:r1-s1:*:*:*:*:*:*",
                    "matchCriteriaId": "8B74AC3E-8FC9-400A-A176-4F7F21F10756",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:23.4:r1-s2:*:*:*:*:*:*",
                    "matchCriteriaId": "CB2D1FCE-8019-4CE1-BA45-D62F91AF7B51",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:23.4:r2:*:*:*:*:*:*",
                    "matchCriteriaId": "175CCB13-76C0-44A4-A71D-41E22B92EB23",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:23.4:r2-s1:*:*:*:*:*:*",
                    "matchCriteriaId": "166BFDB3-1945-4949-BC2B-E18442FF2E4D",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:23.4:r2-s2:*:*:*:*:*:*",
                    "matchCriteriaId": "5923610F-878C-48CA-8B5D-9C609E4DD4DB",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:23.4:r2-s3:*:*:*:*:*:*",
                    "matchCriteriaId": "A7C207E3-0252-4192-8E8C-E2ED2831B4F4",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:23.4:r2-s4:*:*:*:*:*:*",
                    "matchCriteriaId": "E6974492-FE69-4340-8881-61C3329C1545",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:23.4:r2-s5:*:*:*:*:*:*",
                    "matchCriteriaId": "279E59FE-96DF-4E1D-A3A2-61D180F04533",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:23.4:r2-s6:*:*:*:*:*:*",
                    "matchCriteriaId": "4D9A36E5-A1BB-46E1-91B6-91A4C40C1B59",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:24.2:-:*:*:*:*:*:*",
                    "matchCriteriaId": "89524D6D-0B22-4952-AD8E-8072C5A05D5C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:24.2:r1:*:*:*:*:*:*",
                    "matchCriteriaId": "AD69A194-1B03-44EA-8092-79BD10C6F729",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:24.2:r1-s1:*:*:*:*:*:*",
                    "matchCriteriaId": "8463ADB4-B8A7-4D63-97A9-232ED713A21C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:24.2:r1-s2:*:*:*:*:*:*",
                    "matchCriteriaId": "FE68337F-106E-4317-A5B6-292B0159F577",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:24.2:r2:*:*:*:*:*:*",
                    "matchCriteriaId": "266B520A-482A-43F7-90F8-B9D64D30034F",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:24.2:r2-s1:*:*:*:*:*:*",
                    "matchCriteriaId": "AC78BC9E-5DA7-4E42-9923-B49A0B7F3564",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:24.2:r2-s2:*:*:*:*:*:*",
                    "matchCriteriaId": "DD99F1B0-82B0-4CD3-8C8F-C0FFF44A8B90",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:24.2:r2-s3:*:*:*:*:*:*",
                    "matchCriteriaId": "619B5EA0-0369-4AFE-AD8B-A3A22B326F9E",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:24.4:-:*:*:*:*:*:*",
                    "matchCriteriaId": "C452BDCB-34E3-42D3-8909-2312356EB70A",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:24.4:r1:*:*:*:*:*:*",
                    "matchCriteriaId": "2B8158F2-2028-40E9-955F-CFD581A32F60",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:24.4:r1-s2:*:*:*:*:*:*",
                    "matchCriteriaId": "1A7233A1-EC7A-4458-9AE1-835480A03A21",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:24.4:r1-s3:*:*:*:*:*:*",
                    "matchCriteriaId": "D74087E2-5CAA-4085-8408-EB70EC1D5D91",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:24.4:r2:*:*:*:*:*:*",
                    "matchCriteriaId": "0EEF1798-F3C2-4645-96E7-1E82368B184D",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:24.4:r2-s1:*:*:*:*:*:*",
                    "matchCriteriaId": "C8BB5EE1-04C7-4DF3-807A-06005ECFEEE5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:24.4:r2-s2:*:*:*:*:*:*",
                    "matchCriteriaId": "4C707226-9C89-4D06-8E8F-2071061E6F2A",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:24.4:r2-s3:*:*:*:*:*:*",
                    "matchCriteriaId": "3C0C59A7-D826-4D14-AE46-2CA9D0900BC3",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:25.2:-:*:*:*:*:*:*",
                    "matchCriteriaId": "1B7572BB-9C77-4214-9C5F-CC83C7B93E37",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:25.2:r1:*:*:*:*:*:*",
                    "matchCriteriaId": "CAADBF98-38BE-40E2-AF1B-9077DCED0809",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:25.2:r1-s1:*:*:*:*:*:*",
                    "matchCriteriaId": "558F0A4C-0C72-4BF1-B2DE-C0D3BFD54BCD",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:25.2:r1-s2:*:*:*:*:*:*",
                    "matchCriteriaId": "127FE528-AB27-4B18-AF3B-1BE7C0AEEE20",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:juniper:mx10004:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "84F7BB7E-3A52-4C23-A4D2-50E75C912AFC",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:juniper:mx10008:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D6F0EA2F-BF7E-45D0-B2B4-8A7B67A9475A",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:juniper:mx2008:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2FEF33EB-B2E0-42EF-A1BB-D41021B6D08F",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:juniper:mx2010:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "27175D9A-CA2C-4218-8042-835E25DFCA43",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:juniper:mx2020:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "00C7FC57-8ACF-45AA-A227-7E3B350FD24F",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:juniper:mx204:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2754C2DF-DF6E-4109-9463-38B4E0465B77",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:juniper:mx240:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F4A26704-A6A4-4C4F-9E12-A0A0259491EF",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:juniper:mx301:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D02580FA-1F11-4568-BAFA-C1E0EAF67100",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:juniper:mx304:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "3F7FB0CC-624D-4AB9-A7AC-BB19838C3B22",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:juniper:mx480:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "104858BD-D31D-40E0-8524-2EC311F10EAC",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:juniper:mx960:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B5E08E1E-0FE4-4294-9497-BBFFECA2A220",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "An Improper Validation of Specified Quantity in Input vulnerability in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS on MX Series allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS).\n\n\nWhen a specific packet is received from device in the same broadcast domain, an affected system calculates the packet size incorrectly. This causes further packet processing to fail, which triggers an FPC major error, resulting in a FPC reset impacting traffic until the FPC has automatically recovered.\n\nAffected scenarios are: MAP-T, or non-IP traffic encapsulated in IP (e.g. MPLS over GRE).\n\nWhen this issue happens the following logs can be observed:\n\nfpc\u003c#\u003e CMError: /fpc/0/pfe/0/cm/0/MQSS(0)/0/MQSS_CMERROR_LI_INT_REG_UNROLL_TAIL_LENGTH_OVF (0x2205eb), scope: pfe, category: functional, severity: major, module: MQSS(0), type: LI: Unroll TAIL length overflow, oc_category: default\nfpc\u003c#\u003e Performing action reset-fru for error /fpc/0/pfe/0/cm/0/MQSS(0)/0/MQSS_CMERROR_LI_INT_REG_UNROLL_TAIL_LENGTH_OVF (0x2205eb) in module: MQSS(0) with scope: pfe category: functional level: major, oc_category: default\n\n\n\n\nThis issue affects Junos OS on MX Series:\n\n\n  *  all versions before 23.2R2-S6,\n  *  23.4 versions before 23.4R2-S7,\n  *  24.2 versions before 24.2R2-S4,\n  *  24.4 versions before 24.4R2-S4,\n  *  25.2 versions before 25.2R2."
          },
          {
            "lang": "es",
            "value": "Una vulnerabilidad de Validaci\u00f3n Incorrecta de Cantidad Especificada en la Entrada en el Motor de Reenv\u00edo de Paquetes (pfe) de Juniper Networks Junos OS en la Serie MX permite a un atacante adyacente no autenticado causar una Denegaci\u00f3n de Servicio (DoS).\n\nCuando se recibe un paquete espec\u00edfico de un dispositivo en el mismo dominio de difusi\u00f3n, un sistema afectado calcula el tama\u00f1o del paquete incorrectamente. Esto hace que el procesamiento posterior de paquetes falle, lo que desencadena un error mayor de FPC, resultando en un reinicio de FPC que afecta el tr\u00e1fico hasta que el FPC se haya recuperado autom\u00e1ticamente.\n\nLos escenarios afectados son: MAP-T, o tr\u00e1fico no IP encapsulado en IP (por ejemplo, MPLS sobre GRE).\n\nCuando ocurre este problema, se pueden observar los siguientes registros:\n\nfpc\u003c#\u003e CMError: /fpc/0/pfe/0/cm/0/MQSS(0)/0/MQSS_CMERROR_LI_INT_REG_UNROLL_TAIL_LENGTH_OVF (0x2205eb), alcance: pfe, categor\u00eda: funcional, gravedad: mayor, m\u00f3dulo: MQSS(0), tipo: LI: Desbordamiento de longitud de COLA de desenrollado, oc_categor\u00eda: predeterminada\nfpc\u003c#\u003e Realizando acci\u00f3n reset-fru para el error /fpc/0/pfe/0/cm/0/MQSS(0)/0/MQSS_CMERROR_LI_INT_REG_UNROLL_TAIL_LENGTH_OVF (0x2205eb) en el m\u00f3dulo: MQSS(0) con alcance: pfe categor\u00eda: funcional nivel: mayor, oc_categor\u00eda: predeterminada\n\nEste problema afecta a Junos OS en la Serie MX:\n\n  *  todas las versiones anteriores a 23.2R2-S6,\n  *  versiones 23.4 anteriores a 23.4R2-S7,\n  *  versiones 24.2 anteriores a 24.2R2-S4,\n  *  versiones 24.4 anteriores a 24.4R2-S4,\n  *  versiones 25.2 anteriores a 25.2R2."
          }
        ],
        "id": "CVE-2026-57019",
        "lastModified": "2026-10-25T15:10:00.147",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 3.6,
              "source": "sirt@juniper.net",
              "type": "Secondary"
            }
          ],
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "YES",
                "Recovery": "AUTOMATIC",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "ADJACENT",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "LOW",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:X/RE:M/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "MODERATE"
              },
              "source": "sirt@juniper.net",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-57019",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-10T13:29:42.438982Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-07-09T22:17:06.707",
        "references": [
          {
            "source": "sirt@juniper.net",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://supportportal.juniper.net/JSA110079"
          }
        ],
        "sourceIdentifier": "sirt@juniper.net",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-1284"
              }
            ],
            "source": "sirt@juniper.net",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-57019",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-10T13:29:42.438982Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-10T13:29:49.623Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "platforms": [
                "MX Series"
              ],
              "product": "Junos OS",
              "vendor": "Juniper Networks",
              "versions": [
                {
                  "lessThan": "23.2R2-S6",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                },
                {
                  "lessThan": "23.4R2-S7",
                  "status": "affected",
                  "version": "23.4",
                  "versionType": "custom"
                },
                {
                  "lessThan": "24.2R2-S4",
                  "status": "affected",
                  "version": "24.2",
                  "versionType": "custom"
                },
                {
                  "lessThan": "24.4R2-S4",
                  "status": "affected",
                  "version": "24.4",
                  "versionType": "custom"
                },
                {
                  "lessThan": "25.2R2",
                  "status": "affected",
                  "version": "25.2",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "datePublic": "2026-07-08T16:00:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "An Improper Validation of Specified Quantity in Input vulnerability in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS on MX Series allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS).\u003cbr\u003e\u003cp\u003e\n\nWhen a specific packet is received from device in the same broadcast domain, an affected system calculates the packet size incorrectly. This causes further packet processing to fail, which triggers an FPC major error, resulting in a FPC reset impacting traffic until the FPC has automatically recovered.\u003c/p\u003e\u003cp\u003eAffected scenarios are: MAP-T, or non-IP traffic encapsulated in IP (e.g. MPLS over GRE).\u003c/p\u003e\u003cp\u003eWhen this issue happens the following logs can be observed:\u003c/p\u003e\u003ctt\u003efpc\u0026lt;#\u0026gt; CMError: /fpc/0/pfe/0/cm/0/MQSS(0)/0/MQSS_CMERROR_LI_INT_REG_UNROLL_TAIL_LENGTH_OVF (0x2205eb), scope: pfe, category: functional, severity: major, module: MQSS(0), type: LI: Unroll TAIL length overflow, oc_category: default\u003cbr\u003e\u003c/tt\u003e\u003ctt\u003efpc\u0026lt;#\u0026gt; Performing action reset-fru for error /fpc/0/pfe/0/cm/0/MQSS(0)/0/MQSS_CMERROR_LI_INT_REG_UNROLL_TAIL_LENGTH_OVF (0x2205eb) in module: MQSS(0) with scope: pfe category: functional level: major, oc_category: default\u003c/tt\u003e\u003cp\u003e\n\n\u003cbr\u003e\u003c/p\u003e\u003cp\u003eThis issue affects Junos OS on MX Series:\u003cbr\u003e\u003c/p\u003e\u003cul\u003e\u003cli\u003eall versions before 23.2R2-S6,\u003c/li\u003e\u003cli\u003e23.4 versions before 23.4R2-S7,\u003c/li\u003e\u003cli\u003e24.2 versions before 24.2R2-S4,\u003c/li\u003e\u003cli\u003e24.4 versions before 24.4R2-S4,\u003c/li\u003e\u003cli\u003e25.2 versions before 25.2R2.\u003c/li\u003e\u003c/ul\u003e\u003cbr\u003e\u003cp\u003e\u003c/p\u003e"
                }
              ],
              "value": "An Improper Validation of Specified Quantity in Input vulnerability in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS on MX Series allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS).\n\n\nWhen a specific packet is received from device in the same broadcast domain, an affected system calculates the packet size incorrectly. This causes further packet processing to fail, which triggers an FPC major error, resulting in a FPC reset impacting traffic until the FPC has automatically recovered.\n\nAffected scenarios are: MAP-T, or non-IP traffic encapsulated in IP (e.g. MPLS over GRE).\n\nWhen this issue happens the following logs can be observed:\n\nfpc\u003c#\u003e CMError: /fpc/0/pfe/0/cm/0/MQSS(0)/0/MQSS_CMERROR_LI_INT_REG_UNROLL_TAIL_LENGTH_OVF (0x2205eb), scope: pfe, category: functional, severity: major, module: MQSS(0), type: LI: Unroll TAIL length overflow, oc_category: default\nfpc\u003c#\u003e Performing action reset-fru for error /fpc/0/pfe/0/cm/0/MQSS(0)/0/MQSS_CMERROR_LI_INT_REG_UNROLL_TAIL_LENGTH_OVF (0x2205eb) in module: MQSS(0) with scope: pfe category: functional level: major, oc_category: default\n\n\n\n\nThis issue affects Junos OS on MX Series:\n\n\n  *  all versions before 23.2R2-S6,\n  *  23.4 versions before 23.4R2-S7,\n  *  24.2 versions before 24.2R2-S4,\n  *  24.4 versions before 24.4R2-S4,\n  *  25.2 versions before 25.2R2."
            }
          ],
          "exploits": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."
                }
              ],
              "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            },
            {
              "cvssV4_0": {
                "Automatable": "YES",
                "Recovery": "AUTOMATIC",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "ADJACENT",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "LOW",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/RE:M",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "MODERATE"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-1284",
                  "description": "CWE-1284 Improper Validation of Specified Quantity in Input",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-09T21:04:41.927Z",
            "orgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968",
            "shortName": "juniper"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://supportportal.juniper.net/JSA110079"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "The following software releases have been updated to resolve this specific issue:\n\nJunos OS: 23.2R2-S6, 23.4R2-S7, 24.2R2-S4, 24.4R2-S4, 25.2R2, 25.4R1, and all subsequent releases."
                }
              ],
              "value": "The following software releases have been updated to resolve this specific issue:\n\nJunos OS: 23.2R2-S6, 23.4R2-S7, 24.2R2-S4, 24.4R2-S4, 25.2R2, 25.4R1, and all subsequent releases."
            }
          ],
          "source": {
            "advisory": "JSA110079",
            "defect": [
              "1912053"
            ],
            "discovery": "USER"
          },
          "title": "Junos OS: MX Series: Specific traffic causes an FPC to reset",
          "workarounds": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "There are no known workarounds for this issue."
                }
              ],
              "value": "There are no known workarounds for this issue."
            }
          ],
          "x_generator": {
            "engine": "Vulnogram 0.1.0-dev"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968",
        "assignerShortName": "juniper",
        "cveId": "CVE-2026-57019",
        "datePublished": "2026-07-09T21:04:41.927Z",
        "dateReserved": "2026-06-23T16:27:00.248Z",
        "dateUpdated": "2026-07-10T13:29:55.755Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.