This vulnerability (CVE-2026-33781) is an improper check for unusual or exceptional conditions (CWE-754) in the packet forwarding engine of Juniper Junos OS on EX4k and QFX5k platforms used as service-provider edge devices. When configured with L2PT enabled on UNI and VSTP enabled on NNI in VXLAN scenarios, receiving VSTP BPDUs on UNI causes packet buffer allocation failures. This results in the device ceasing to forward traffic until manually restarted, causing a complete Denial of Service. Affected versions include Junos OS 24.4 releases before 24.4R2 and 25.2 releases before 25.2R1-S1 and 25.2R2. The vulnerability does not affect versions before 24.4R1. There is no vendor advisory or patch link provided, and no known exploits in the wild have been reported.

An unauthenticated, adjacent attacker can cause a complete Denial of Service on affected Juniper EX4k and QFX5k devices under specific VXLAN configurations. The device stops forwarding traffic due to packet buffer allocation failures triggered by receiving VSTP BPDUs on UNI interfaces. Recovery requires manual device restart, potentially causing network disruption until intervention.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling the vulnerable configuration combinations (L2PT on UNI and VSTP on NNI in VXLAN scenarios) if feasible, or implement network segmentation to limit adjacency of untrusted devices. Monitor Juniper Networks advisories for updates and apply patches promptly once released.