CVE-2026-102048 in Junos OS
Summary
by MITRE • 10/15/2026
An Allocation of Resources Without Limits or Throttling vulnerability in the l2cpd process of Juniper Networks Junos OS allows an adjacent unauthenticated attacker to cause a denial of service and l2cpd restart via FNP-enabled Layer 2 interfaces. The issue is triggered when the FNP feature is enabled on a VPLS routing instance with VLAN-VPLS encapsulation enabled.
This issue affects all platforms except the PTX Series and SRX Series.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified as an Allocation of Resources Without Limits or Throttling represents a critical flaw within the Layer 2 Control Protocol daemon, known as l2cpd, in Juniper Networks Junos OS. This specific weakness allows for resource exhaustion attacks that can lead to service disruption and process restarts. The attack vector is particularly notable because it requires only an adjacent unauthenticated attacker, meaning no prior authentication or privileged access on the network device is necessary to exploit this flaw. The exploitation occurs through FNP-enabled Layer 2 interfaces, which are designed to facilitate specific forwarding plane interactions but inadvertently expose a mechanism for resource depletion when certain configuration conditions are met.
The technical root cause of this vulnerability lies in the interaction between the Forwarding Plane Notification feature and Virtual Private LAN Service configurations. Specifically, the issue is triggered when FNP is enabled on a VPLS routing instance that also has VLAN-VPLS encapsulation configured. Under these specific circumstances, an attacker can send crafted Layer 2 frames or control protocol messages that cause the l2cpd process to allocate excessive system resources without adequate throttling mechanisms in place. This uncontrolled allocation leads to resource exhaustion within the daemon, ultimately causing it to crash and restart. The restart of this critical background process results in a denial of service for network operations dependent on Layer 2 control plane functions, potentially disrupting connectivity and stability across the affected infrastructure segments.
From an operational impact perspective, the consequences are severe due to the unauthenticated nature of the attack. An adjacent attacker could be any device physically connected or logically reachable at the data link layer without needing valid credentials for the router itself. The resulting denial of service can lead to intermittent connectivity issues, loss of Layer 2 adjacency protocols such as LLDP or CDP if they rely on similar control plane mechanisms, and general instability in VPLS deployments. Since l2cpd handles critical forwarding decisions related to layer two encapsulation, its restart may cause temporary blackholing of traffic or require manual intervention to restore full service levels after the process recovers. This creates a significant availability risk for organizations relying on Junos-based infrastructure for enterprise WAN or data center interconnects using VPLS technologies.
In terms of industry standard classifications, this vulnerability aligns with CWE-770: Allocation of Resources Without Limits or Throttling and falls under the MITRE ATT&CK technique T1498: Network Denial of Service. The attack vector is classified as adjacent network access, indicating that physical proximity to the switched segment or logical adjacency in a broadcast domain is required. This classification highlights the importance of securing Layer 2 boundaries and implementing strict ingress filtering even for untrusted devices connected to management or service interfaces where FNP might be enabled.
Mitigation strategies should focus on both configuration hardening and network segmentation. Administrators should review all VPLS configurations across their Juniper platforms, excluding PTX Series and SRX Series which are not affected by this specific flaw, to determine if VLAN-VPLS encapsulation is combined with FNP features. If the use case does strictly require these combinations, it is imperative to apply any available vendor patches or software updates that address the resource throttling logic within l2cpd. Furthermore, network architects should implement strict access control lists on Layer 2 interfaces where possible and restrict physical access to ports configured for such sensitive forwarding plane notifications. Deploying intrusion detection systems capable of monitoring anomalous traffic patterns at the data link layer can also provide early warning indicators of exploitation attempts before significant resource exhaustion occurs. Regular auditing of interface configurations against this specific vulnerability profile is recommended until comprehensive patching is applied across all affected non-PTX and non-SRX platforms.