Junos OS Evolved CFM daemon: valid adjacent traffic pins CPU and leaks cfmman memory until the FPC crashes

Impact

An unauthenticated attacker on an adjacent device can send specific valid CFM traffic that drives cfmd to 100% CPU and leaks cfmman memory until the FPC crashes and restarts; continued traffic sustains the denial of service. On PTX10000-class boxes carrying datacenter or cluster uplinks, an FPC restart drops every link on that card - a GPU training job spread across racks behind that switch loses its east-west or north-south path mid-run, and the restart repeats as long as the traffic continues. Operators can watch for it by checking cfmman RSS growth per FPC (show system processes node fpc<num> detail | match cfmman); RSS climbing into gigabytes is the indicator of compromise Juniper names. Only devices with CFM configured are exposed.

Who can reach it

Anyone on a directly adjacent device in the Layer 2 domain - no authentication needed. Requires CFM to be configured and the traffic to arrive on a CFM-enabled interface, so the exposure is to connected peers and whatever can inject frames into that segment, not to the internet.

What to do

Upgrade Junos OS Evolved past the fixed releases: 23.2R2-S4-EVO, 23.4R2-S4-EVO, 24.2R2-EVO, 24.4R1-S2-EVO or 24.4R2-EVO. That is a routing-engine upgrade and reboot of the switch, so it needs a maintenance window with traffic drained off the device or redundant paths in place. Interim mitigation per Juniper's advisory is to monitor cfmman RSS and restart the device to clear leaked memory; disabling CFM where it is not needed removes the exposure. Releases before 23.2R1-EVO are unaffected.

References

Related entries

• AMI AptioV BIOS: integer overflow leads to memory corruption and firmware code executionCVE-2025-58771 · AMI AptioV UEFI firmware (BIOS)High
• AMI AptioV BIOS: out-of-bounds write enables firmware memory corruption and code executionCVE-2025-58773 · AMI AptioV UEFI firmware (BIOS)High
• Arista EOS: crafted DHCP packet restarts the DHCP relay service on client-facing VLANsCVE-2026-19655 · Arista EOS DHCP relay (Option 82 information option handling)High
• Cisco UCS UEFI Shell: memory write commands bypass Secure Boot validationCVE-2026-20293 · Cisco UCS server BIOS (UEFI Shell)High
• Linux bnxt_en driver (DBG_BUF_PRODUCER async event handler): The async-event handler indexes a fixed arrayCVE-2026-31395 · Linux bnxt_en driver (DBG_BUF_PRODUCER async event handler)High
• Junos OS MX Series PFE: micro-BFD flapping starves PFEMAN until the watchdog crashes and restarts the FPCCVE-2026-33800 · Juniper Junos OS on MX Series (Packet Forwarding Engine, PFEMAN micro-BFD event processing)High