FKIE_CVE-2026-33781

Vulnerability from fkie_nvd - Published: 2026-04-09 22:16 - Updated: 2026-04-17 17:53
Severity
6.5 (Medium) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
An Improper Check for Unusual or Exceptional Conditions vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on specific EX and QFX Series devices allow an unauthenticated, adjacent attacker to cause a complete Denial of Service (DoS). On EX4k, and QFX5k platforms configured as service-provider edge devices, if L2PT is enabled on the UNI and VSTP is enabled on NNI in VXLAN scenarios, receiving VSTP BPDUs on UNI leads to packet buffer allocation failures, resulting in the device to not pass traffic anymore until it is manually recovered with a restart.This issue affects Junos OS: * 24.4 releases before 24.4R2, * 25.2 releases before 25.2R1-S1, 25.2R2. This issue does not affect Junos OS releases before 24.4R1.
References
sirt@juniper.nethttps://kb.juniper.net/JSA107869Mitigation, Vendor Advisory
Impacted products
Vendor Product Version
juniper junos 24.4
juniper junos 24.4
juniper junos 24.4
juniper junos 24.4
juniper junos 25.2
juniper junos 25.2
juniper junos 25.2
juniper ex4000 -
juniper ex4100 -
juniper ex4100-f -
juniper ex4100-h -
juniper ex4300 -
juniper ex4400 -
juniper ex4600 -
juniper ex4650 -
juniper qfx5110 -
juniper qfx5120 -
juniper qfx5130 -
juniper qfx5200 -
juniper qfx5210 -
juniper qfx5220 -
juniper qfx5230-64cd -
juniper qfx5240 -
juniper qfx5241 -
juniper qfx5700 -
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:juniper:junos:24.4:-:*:*:*:*:*:*",
              "matchCriteriaId": "C452BDCB-34E3-42D3-8909-2312356EB70A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:24.4:r1:*:*:*:*:*:*",
              "matchCriteriaId": "2B8158F2-2028-40E9-955F-CFD581A32F60",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:24.4:r1-s2:*:*:*:*:*:*",
              "matchCriteriaId": "1A7233A1-EC7A-4458-9AE1-835480A03A21",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:24.4:r1-s3:*:*:*:*:*:*",
              "matchCriteriaId": "D74087E2-5CAA-4085-8408-EB70EC1D5D91",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:25.2:-:*:*:*:*:*:*",
              "matchCriteriaId": "1B7572BB-9C77-4214-9C5F-CC83C7B93E37",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:25.2:r1:*:*:*:*:*:*",
              "matchCriteriaId": "CAADBF98-38BE-40E2-AF1B-9077DCED0809",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:25.2:r2:*:*:*:*:*:*",
              "matchCriteriaId": "6C7B9DEB-7472-4010-8717-8050555C2FAD",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:juniper:ex4000:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "152FD759-F5D2-4ACE-ADD6-7FE89B31D961",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:juniper:ex4100:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "C2521C83-E8F2-4621-9727-75BB3FC11E64",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:juniper:ex4100-f:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "6F496D19-D28C-4517-90A3-90EC62BC5D79",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:juniper:ex4100-h:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7DA4A8C7-EBC0-449E-BD37-69FABDC917C2",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:juniper:ex4300:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E594D6DC-87F6-40D2-8268-ED6021462168",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:juniper:ex4400:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "4B43F6CB-0595-4957-8B3B-ADD4EA84D8C2",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:juniper:ex4600:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "D1BB20B5-EA30-4E8E-9055-2E629648436A",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:juniper:ex4650:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "2B425BB1-3C78-42B1-A6C1-216E514191F0",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:juniper:qfx5110:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "79A8847B-4F98-4949-8639-5CD2B411D10F",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:juniper:qfx5120:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "09EBDE4B-764F-4DF1-844A-BB8A52CD53EF",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:juniper:qfx5130:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "AB58A6E9-FFCF-4331-AC3B-45C37BD1943E",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:juniper:qfx5200:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "EDC5478F-A047-4F6D-BB11-0077A74C0174",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:juniper:qfx5210:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "D877320D-1997-4B66-B11B-864020C755E1",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:juniper:qfx5220:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "D193BEBD-9436-468D-B89E-D5720603451D",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:juniper:qfx5230-64cd:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "9F3D09BE-C16F-4E77-B6FB-C0C58BBD7675",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:juniper:qfx5240:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "9ABF8F9D-45C1-4554-A213-435A68709FCB",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:juniper:qfx5241:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "685120A6-7005-4ECB-A37F-0F225BB92676",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:juniper:qfx5700:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "C7D6C74F-E85F-4D62-BDAF-FE619B467C76",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An Improper Check for Unusual or Exceptional Conditions vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on specific EX and QFX Series devices allow an unauthenticated, adjacent attacker to cause a complete Denial of Service (DoS).\n\nOn EX4k, and QFX5k platforms configured as service-provider edge devices, if L2PT is enabled on the UNI and VSTP is enabled on NNI in VXLAN scenarios, receiving VSTP BPDUs on UNI leads to packet buffer allocation failures, resulting in the device to not pass traffic anymore until it is manually recovered with a restart.This issue affects Junos OS:\n\n\n\n  *  24.4 releases before 24.4R2,\n  *  25.2 releases before 25.2R1-S1, 25.2R2.\n\n\n\n\nThis issue does not affect Junos OS releases before 24.4R1."
    }
  ],
  "id": "CVE-2026-33781",
  "lastModified": "2026-04-17T17:53:32.403",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "sirt@juniper.net",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "YES",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "ADJACENT",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "LOW",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:M/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "MODERATE"
        },
        "source": "sirt@juniper.net",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-04-09T22:16:27.193",
  "references": [
    {
      "source": "sirt@juniper.net",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://kb.juniper.net/JSA107869"
    }
  ],
  "sourceIdentifier": "sirt@juniper.net",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-754"
        }
      ],
      "source": "sirt@juniper.net",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.