Database/Firmware, BMC & network fabric
Junos l2ald: EVPN Type-2 MAC/IP routes trigger an integer overflow and a Layer 2 learning outage
Impact
An integer overflow in l2ald, the Layer 2 address learning daemon, lets a configured EVPN BGP peer cause a denial of service via EVPN Type-2 MAC/IP routes. This is a different daemon from the rpd bugs in the same advisory: the damage is to MAC learning and the local bridging state rather than route selection, so the symptom on a GPU fabric is overlay forwarding breaking for hosts on that leaf even while BGP looks healthy. Type-2 routes are the ordinary traffic of an EVPN fabric, so there is no exotic feature to turn off here.
Who can reach it
A configured EVPN BGP peer able to advertise Type-2 MAC/IP routes to the device. No authentication beyond the peering.
What to do
Upgrade Junos OS / Junos OS Evolved to a fixed release per Juniper JSA112187; the upgrade reboots the switch. No configuration mitigation is stated - Type-2 routes cannot be dropped without breaking the fabric - so the practical control until patching is which devices may peer EVPN.
References
Related entries
- Junos OS on MX: infinite loop in netsctp.ko lets crafted SCTP traffic hang the deviceCVE-2026-102046 · Juniper Junos OS netsctp.ko on MX Series (SCTP processing)High
- Junos l2cpd: LLDP packets overflow a stack buffer, root code execution or Layer 2 control-plane denial of serviceCVE-2026-102049 · Juniper Junos OS / Junos OS Evolved l2cpd (LLDP processing)High
- Junos jdhcpd: malformed DHCPv4 server response gives root code execution on the deviceCVE-2026-102052 · Juniper Junos OS / Junos OS Evolved jdhcpd (DHCPv4 local-client)High
- Junos cfmd: CFM message to a down-MEP executes code as root with enhanced CFM mode enabledCVE-2026-102055 · Juniper Junos OS cfmd on MX Series / Junos OS Evolved on PTX Series (enhanced CFM)High
- Junos OS: stack overflow in jdhcpd lets an adjacent attacker break DHCP, relay and ZTPCVE-2026-102057 · Juniper Junos OS jdhcpd (DHCP client response handling)High
- Junos phone-home daemon: rogue DHCP server injects OS commands and runs them as rootCVE-2026-102059 · Juniper Junos OS / Junos OS Evolved phcd (phone-home daemon) on EX, SRX, QFXHigh
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.