CVE-2026-102053 in Junos OS
Summary
by MITRE • 10/15/2026
An Improper Release of Memory Before Removing Last Reference vulnerability in the l2ald process of Juniper Networks Junos OS and Junos OS Evolved on QFX5K-family platforms allows a configured EVPN peer to cause a denial of service through memory exhaustion via EVPN-VXLAN active-active multihoming route processing.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified as an improper release of memory before removing the last reference represents a critical resource management flaw within the Layer 2 Adjacency Discovery (l2ald) process of Juniper Networks Junos OS and Junos OS Evolved, specifically affecting QFX5K-family platforms. This defect is triggered during the processing of Ethernet Virtual Private Network over VXLAN active-active multihoming routes by configured EVPN peers. In a properly functioning system, memory allocated for specific routing table entries or state information should be deallocated only after all references to that data structure have been safely removed and no other processes are accessing it. However, in this scenario, the l2ald process fails to adhere to this principle during complex route processing scenarios involving active-active multihoming configurations. This architectural oversight leads to a situation where memory blocks remain allocated even though they should be freed, creating a gradual accumulation of unreleased resources within the control plane.
The operational impact of this vulnerability is severe, primarily manifesting as a denial of service condition caused by memory exhaustion on the affected network devices. As the device continues to process EVPN routes in an active-active multihoming environment, the cumulative effect of these improper releases causes system memory usage to rise steadily over time. Eventually, the available memory for critical control plane functions is depleted, leading to instability within the routing engine. This can result in the l2ald process crashing or restarting repeatedly, which disrupts network connectivity and prevents the device from correctly maintaining Layer 2 adjacency information. For enterprise networks relying on high-availability EVPN deployments, this instability undermines the reliability of the infrastructure, potentially causing service outages for connected tenants or applications that depend on stable VXLAN tunnel endpoints.
From a technical classification perspective, this vulnerability aligns with CWE-401, which describes missing release of memory after removing last reference. This category encompasses errors where software fails to free allocated memory when it is no longer needed, leading to resource leaks. The exploitation vector for this issue does not require external network traffic from an unauthenticated attacker; rather, it relies on the presence of a configured EVPN peer sending specific route updates that trigger the flawed code path within the l2ald process. Consequently, while the initial configuration must be established by an administrator with appropriate privileges, the actual triggering event can occur through normal operational routing exchanges if the remote peer sends routes in a manner that exposes this logic error. This places the vulnerability in a context where internal network trust boundaries are bypassed due to protocol-level processing flaws rather than direct external exploitation of input validation failures.
Mitigation strategies for this issue primarily involve applying vendor-provided software updates or patches that correct the memory management logic within the l2ald process. Administrators should ensure their Junos OS and Junos OS Evolved installations on QFX5K platforms are updated to versions where this specific race condition or reference counting error has been resolved. In environments where immediate patching is not feasible, network operators can consider mitigating risk by reviewing EVPN configurations for active-active multihoming setups that may be particularly susceptible to triggering the flaw during route convergence events. Monitoring system memory usage trends on affected devices can also provide early warning signs of this resource leak before it leads to a complete denial of service condition. Long-term architectural reviews should focus on ensuring that critical control plane processes adhere strictly to reference counting best practices, verifying that all dynamic allocations are paired with corresponding deallocations upon state transitions or route withdrawals.