CVE-2026-102036 in Junos OS
Summary
by MITRE • 10/14/2026
An Integer Overflow or Wraparound vulnerability in the l2ald process of Juniper Networks Junos OS and Junos OS Evolved allows a configured EVPN BGP peer to cause a denial of service via EVPN Type-2 MAC/IP routes.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The identified vulnerability resides within the Layer 2 Advertisement (l2ald) process of Juniper Networks Junos Operating System and Junos OS Evolved, representing a critical flaw in how routing protocol data is processed for Ethernet Virtual Private Network (EVPN) deployments. Specifically, this integer overflow or wraparound issue affects the handling of EVPN Type-2 MAC/IP advertisement routes received from configured BGP peers. In network infrastructure software, such processes are responsible for translating control plane information into forwarding table entries that dictate how traffic is switched across the network fabric. When an attacker with access to a peering session can inject specifically crafted packets containing malformed route attributes, they can trigger arithmetic errors during the internal calculation of resource allocation or index mapping within the l2ald process. This type of vulnerability typically occurs when software fails to properly validate input values before performing mathematical operations, leading to integer wraparound where large positive numbers are interpreted as negative numbers or vice versa, causing buffer overflows or logic errors that destabilize the application state.
From an operational perspective, the primary impact of this flaw is a denial of service against the affected router or network device. Because the vulnerability targets the control plane process responsible for maintaining routing and forwarding information, exploitation does not necessarily require remote code execution but rather precise manipulation of protocol messages to crash the l2ald daemon. When this process fails, the device may cease to properly update its MAC address tables or ARP caches associated with EVPN segments. This results in a loss of connectivity for virtual LANs relying on that specific node, effectively isolating endpoints within the data center or enterprise network. For service providers and large enterprises utilizing BGP-based EVPN architectures for multi-tenancy and scale, such an outage can lead to significant business disruption, as critical services dependent on stable Layer 2 segmentation become unreachable until the process is restarted or the device is rebooted.
This vulnerability aligns with Common Weakness Enumeration (CWE) category CWE-190, which defines Integer Overflow or Wraparound, and specifically impacts the integrity and availability aspects of the CIA triad. In terms of offensive security frameworks, this flaw can be leveraged via techniques associated with MITRE ATT&CK ID T1498, Network Denial of Service, where an adversary uses specific network traffic patterns to exhaust resources or crash services rather than compromising confidentiality. The attack vector is classified as adjacent network accessible if the attacker must be on a directly connected subnet, but potentially remote if BGP peering extends across untrusted networks without sufficient filtering. Mitigation strategies primarily involve applying vendor-provided software patches that correct the input validation logic within the l2ald module to ensure proper bounds checking for all route attributes before processing. Additionally, network administrators should implement strict prefix lists and route filters on BGP peer sessions to restrict the types of EVPN routes accepted from external peers, thereby reducing the attack surface by preventing malformed or excessively large attribute values from reaching the vulnerable process until a permanent fix is deployed.