Denial of Service Vulnerability in Junos OS Affecting Juniper Networks Devices
CVE-2026-33781

7.1HIGH

Key Information:

Vendor

Juniper Networks
Status
Junos Os
Vendor
CVE Published:
9 April 2026

Badges

👾 Exploit Exists

What is CVE-2026-33781?

A vulnerability in the packet forwarding engine of Juniper Networks Junos OS can lead to a denial of service on certain EX and QFX Series devices under specific configurations. When L2PT is enabled on the UNI and VSTP on the NNI in VXLAN setups, affected devices may experience packet buffer allocation failures upon receiving VSTP BPDUs. This malfunction causes the device to stop passing traffic and necessitates a manual restart for recovery. Devices operating on Junos OS versions prior to 24.4R2 for 24.4 releases and prior to 25.2R1-S1 and 25.2R2 in the 25.2 releases are particularly vulnerable.

Affected Version(s)

Junos OS EX Series 24.4 < 24.4R2

Junos OS EX Series 25.2 < 25.2R1-S1, 25.2R2

Junos OS EX Series 0 < 24.4R1

References

https://kb.juniper.net/JSA107869
vendor-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.