Riskcovery

CVE-2026-33780

Junos OS and Junos OS Evolved: In an EVPN-MPLS scenario churn of ESI routes causes a memory leak in l2ald

State
Published
Severity
7.1 High
Published
Apr 9, 2026
Updated
Apr 13, 2026
Reserved
Mar 23, 2026

Read the record on cve.org

Description

A Missing Release of Memory after Effective Lifetime vulnerability in the Layer 2 Address Learning Daemon (l2ald) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated attacker to cause a memory leak ultimately leading to a Denial of Service (DoS).

In an EVPN-MPLS scenario, routes learned from remote multi-homed Provider Edge (PE) devices are programmed as ESI routes. Due to a logic issue in the l2ald memory management, memory allocated for these routes is not released when there is churn for these routes. As a result, memory leaks in the l2ald process which will ultimately lead to a crash and restart of l2ald.

Use the following command to monitor the memory consumption by l2ald:

user@device> show system process extensive | match "PID|l2ald"

This issue affects:

Junos OS:

* all versions before 22.4R3-S5, * 23.2 versions before 23.2R2-S3, * 23.4 versions before 23.4R2-S4, * 24.2 versions before 24.2R2;

Junos OS Evolved:

* all versions before 22.4R3-S5-EVO, * 23.2 versions before 23.2R2-S3-EVO, * 23.4 versions before 23.4R2-S4-EVO, * 24.2 versions before 24.2R2-EVO.

Scores

CVSSScoreVectorSource
4.07.1 HighCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/RE:Mjuniper
3.16.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hjuniper

Weaknesses

  • CWE-401 Missing Release of Memory after Effective Lifetime

Affected Products

ProductVersions
Junos OSJuniper Networks
  • before 22.4R3-S5Affected
  • 23.2 to before 23.2R2-S3Affected
  • 23.4 to before 23.4R2-S4Affected
  • 24.2 to before 24.2R2Affected
Junos OS EvolvedJuniper Networks
  • all version prior to to before 22.4R3-S5-EVOAffected
  • 23.2 to before 23.2R2-S3-EVOAffected
  • 23.4 to before 23.4R2-S4-EVOAffected
  • 24.2 to before 24.2R2-EVOAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.