CVE-2026-101994: CWE-130 Improper Handling of Length Parameter Inconsistency in Juniper Networks Junos OS

This vulnerability (CVE-2026-101994) arises from improper handling of length parameter inconsistencies in the l2ald daemon of Juniper Networks Junos OS and Junos OS Evolved. Specifically, an attacker able to control or impersonate a configured MC-LAG ICCP peer can send a malformed ICCP message that leads to disclosure of process heap memory or triggers a denial of service condition. The issue is classified under CWE-130 (Improper Handling of Length Parameter Inconsistency). The vulnerability affects multiple version ranges of Junos OS and Junos OS Evolved, including both standard and EVO variants, with fixed versions starting at various release points such as 23.2R2-S7.7 and later. The CVSS 3.1 vector indicates the attack requires adjacent network access with low complexity, no privileges or user interaction, and impacts confidentiality and availability.

An attacker who can control or impersonate a configured MC-LAG ICCP peer can exploit this vulnerability to disclose sensitive process heap memory, potentially leaking information, or cause a denial of service, disrupting the affected system's operation. The impact on confidentiality is limited (partial disclosure), but the availability impact is high due to potential service disruption. No integrity impact is indicated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch links are provided, users should monitor Juniper Networks advisories for updates and apply patches or mitigations once available. In the meantime, restrict or monitor access to MC-LAG ICCP peers to trusted entities only to reduce risk.