CVE-2026-102032: CWE-401 Improper Release of Memory Before Removing Last Reference in Juniper Networks Junos OS

This vulnerability (CVE-2026-102032) is a missing release of memory after the effective lifetime in the l2ald process of Juniper Networks Junos OS and Junos OS Evolved. When the static MAC-IP feature is in use, an unauthenticated attacker with adjacent network access can send crafted packets that trigger a denial of service by exhausting memory resources. The issue is categorized under CWE-401 (Improper Release of Memory Before Removing Last Reference). The CVSS v3.1 base score is 6.5 (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating a medium severity denial of service impact without confidentiality or integrity loss. The vulnerability affects multiple versions across Junos OS and Junos OS Evolved branches as specified.

The vulnerability allows an unauthenticated adjacent attacker to cause a denial of service by triggering a memory leak in the l2ald process when the static MAC-IP feature is enabled. This results in service disruption but does not impact confidentiality or integrity of the system. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, consider disabling the static MAC-IP feature if feasible to reduce exposure. Monitor vendor advisories for updates on remediation.