An improper check for unusual or exceptional conditions (CWE-754) exists in the packet forwarding engine of Juniper Networks Junos OS on EX4k and QFX5k platforms configured as service-provider edge devices. When L2PT is enabled on the UNI interface and VSTP is enabled on the NNI interface in VXLAN scenarios, receiving VSTP BPDUs on the UNI interface leads to packet buffer allocation failures. This causes the device to stop forwarding traffic until manually restarted, resulting in a denial of service. The vulnerability affects Junos OS versions 24.4 prior to 24.4R2 and 25.2 prior to 25.2R1-S1 and 25.2R2. Releases before 24.4R1 are not affected. There is no vendor advisory or patch information available at this time.

An unauthenticated, adjacent attacker can cause a complete denial of service on affected Juniper EX4k and QFX5k devices by triggering packet buffer allocation failures through specific VXLAN configurations involving L2PT and VSTP. The device stops passing traffic until manually restarted, impacting network availability. There is no impact on confidentiality or integrity reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, network operators should consider disabling the affected features (L2PT on UNI or VSTP on NNI in VXLAN scenarios) if feasible or implement network controls to prevent receipt of VSTP BPDUs on UNI interfaces from untrusted adjacent sources. Manual device restart is required to recover from the denial of service condition.