Junos OS MX Series PFE: micro-BFD flapping starves PFEMAN until the watchdog crashes and restarts the FPC

CVE-2026-33800Firmware, BMC & network fabriccurated

Impact

An attacker on an adjacent link that can keep micro-BFD sessions flapping enqueues up/down events faster than PFEMAN can drain them; the PFEMAN watchdog eventually expires and the FPC crashes and restarts. That is a full forwarding outage for every port on the line card, not a degraded path. Juniper notes the processing cost is worst in a Virtual-Chassis with locality-bias configured. On a fleet where an MX sits on the storage or WAN edge of the GPU pods, an FPC restart drops the traffic of everything homed behind it for the duration of the reload, and a flapping neighbour can repeat it.

Who can reach it

Unauthenticated attacker adjacent at layer 2 on a link running micro-BFD to the device - no credentials, just the ability to make those sessions flap repeatedly.

What to do

Upgrade Junos OS on MX to 23.2R2-S7, 23.4R2-S8, 24.2R2-S4, 24.4R2-S3 or 25.2R2 per JSA110075; that is a chassis software upgrade with a reboot, so it needs a maintenance window per device. Only MX FPCs up to and including MPC9, plus LC2101/2103 and LC480, are affected - MPC10/11, LC4800/9600 and MX304 are not, so inventory line cards before scheduling. Juniper's advisory does not describe a configuration-only workaround.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-33800 https://supportportal.juniper.net/JSA110075

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.