CVE-2026-102036: CWE-190 Integer Overflow or Wraparound in Juniper Networks Junos OS

This vulnerability is an integer overflow or wraparound (CWE-190) in the l2ald process of Juniper Networks Junos OS and Junos OS Evolved. A maliciously configured EVPN BGP peer can exploit this flaw by sending EVPN Type-2 MAC/IP routes that trigger the overflow, leading to a denial of service condition. The issue affects multiple versions of Junos OS and Junos OS Evolved, with affected versions ranging from early releases up to but not including various fixed versions identified by release numbers and patch levels. The vulnerability has a CVSS 3.1 base score of 7.5, with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability (denial of service). No known exploits are reported in the wild at this time.

Successful exploitation results in denial of service of the affected Junos OS or Junos OS Evolved device's l2ald process, potentially disrupting network operations. There is no impact on confidentiality or integrity reported. The attack can be performed remotely by an unauthenticated EVPN BGP peer, increasing the risk in environments where such peers are configured.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fix information is provided in the input data, users should monitor Juniper Networks advisories for updates. In the meantime, restricting or carefully controlling EVPN BGP peer configurations may reduce exposure. No vendor advisory states that no action is required or that the issue is already mitigated.