CVE-2026-101995: CWE-1284 Improper Validation of Specified Quantity in Input in Juniper Networks Junos OS

This vulnerability (CVE-2026-101995) in Juniper Networks Junos OS and Junos OS Evolved arises from improper validation of specified quantity in input to the l2ald daemon. An adjacent attacker who has access to an ICCP peer session can send malformed ICCP packets that cause memory disclosure and disrupt the l2ald daemon. The issue affects multiple versions across several release trains, including both standard and evolved versions. The CVSS 3.1 base score is 4.3, reflecting a medium severity with attack vector as adjacent network, low attack complexity, no privileges required, no user interaction, and impact limited to availability.

An attacker with adjacent network access to an ICCP peer session can exploit this vulnerability to cause memory disclosure and disrupt the l2ald daemon, resulting in denial of service. There is no impact on confidentiality or integrity according to the CVSS vector. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Juniper Networks advisories for updates. Until a fix is available, limit access to ICCP peer sessions to trusted entities to reduce exposure.