Juniper Junos OS up to 25.2R1 Packet Forwarding Engine MQSS_CMERROR_LI_INT_REG_UNROLL_TAIL_LENGTH_OVF input validation

Summaryinfo

A vulnerability was found in Juniper Junos OS up to 23.2R2-S5/23.4R2-S6/24.2R2-S3/24.4R2-S3/25.2R1 and classified as critical. Affected is an unknown function of the file /fpc/0/pfe/0/cm/0/MQSS(0)/0/MQSS_CMERROR_LI_INT_REG_UNROLL_TAIL_LENGTH_OVF of the component Packet Forwarding Engine. Executing a manipulation can lead to input validation. This vulnerability is tracked as CVE-2026-57019. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability was found in Juniper Junos OS up to 23.2R2-S5/23.4R2-S6/24.2R2-S3/24.4R2-S3/25.2R1. It has been declared as critical. This vulnerability affects an unknown code of the file /fpc/0/pfe/0/cm/0/MQSS(0)/0/MQSS_CMERROR_LI_INT_REG_UNROLL_TAIL_LENGTH_OVF of the component Packet Forwarding Engine. The manipulation with an unknown input leads to a input validation vulnerability. The CWE definition for the vulnerability is CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. As an impact it is known to affect availability. CVE summarizes:

An Improper Validation of Specified Quantity in Input vulnerability in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS on MX Series allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS). When a specific packet is received from device in the same broadcast domain, an affected system calculates the packet size incorrectly. This causes further packet processing to fail, which triggers an FPC major error, resulting in a FPC reset impacting traffic until the FPC has automatically recovered. Affected scenarios are: MAP-T, or non-IP traffic encapsulated in IP (e.g. MPLS over GRE). When this issue happens the following logs can be observed: fpc<#> CMError: /fpc/0/pfe/0/cm/0/MQSS(0)/0/MQSS_CMERROR_LI_INT_REG_UNROLL_TAIL_LENGTH_OVF (0x2205eb), scope: pfe, category: functional, severity: major, module: MQSS(0), type: LI: Unroll TAIL length overflow, oc_category: default fpc<#> Performing action reset-fru for error /fpc/0/pfe/0/cm/0/MQSS(0)/0/MQSS_CMERROR_LI_INT_REG_UNROLL_TAIL_LENGTH_OVF (0x2205eb) in module: MQSS(0) with scope: pfe category: functional level: major, oc_category: default This issue affects Junos OS on MX Series: * all versions before 23.2R2-S6, * 23.4 versions before 23.4R2-S7, * 24.2 versions before 24.2R2-S4, * 24.4 versions before 24.4R2-S4, * 25.2 versions before 25.2R2.

The advisory is shared for download at supportportal.juniper.net. This vulnerability was named CVE-2026-57019 since 06/23/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 07/10/2026).

Upgrading to version 23.2R2-S6, 23.4R2-S7, 24.2R2-S4, 24.4R2-S4 or 25.2R2 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• Juniper

Name

• Junos OS

Version

• 23.2R2-S5
• 23.4R2-S6
• 24.2R2-S3
• 24.4R2-S3
• 25.2R1

License

• commercial

Website

• Vendor: https://www.juniper.net/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion