CVE-2026-102051: CWE-401 Improper Release of Memory Before Removing Last Reference in Juniper Networks Junos OS

This vulnerability (CVE-2026-102051) is due to improper release of memory before removing the last reference in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved platforms. An adjacent unauthenticated attacker can exploit this by sending LLDP traffic when fast receive processing is enabled, leading to memory exhaustion in l2cpd and disruption of the Layer 2 control plane. The CVSS 3.1 base score is 6.5, reflecting a medium severity with attack vector adjacent network, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, but high availability impact. The affected versions span multiple release ranges of both Junos OS and Junos OS Evolved platforms as detailed in the affectedVersions field. There is no vendor advisory or patch link provided in the input data.

The vulnerability allows an adjacent unauthenticated attacker to cause memory exhaustion in the l2cpd process, resulting in disruption of the Layer 2 control plane. This impacts the availability of the affected Junos OS devices but does not affect confidentiality or integrity. The attack requires adjacency to the network and no privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround information is provided, users should monitor Juniper Networks advisories for updates. Until a fix is available, consider disabling fast receive processing if feasible or implementing network controls to limit LLDP traffic from untrusted adjacent devices.