CVE-2026-57019: CWE-1284 Improper Validation of Specified Quantity in Input in Juniper Networks Junos OS
An Improper Validation of Specified Quantity in Input vulnerability in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS on MX Series allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS). When a specific packet is received from device in the same broadcast domain, an affected system calculates the packet size incorrectly. This causes further packet processing to fail, which triggers an FPC major error, resulting in a FPC reset impacting traffic until the FPC has automatically recovered. Affected scenarios are: MAP-T, or non-IP traffic encapsulated in IP (e.g. MPLS over GRE). When this issue happens the following logs can be observed: fpc<#> CMError: /fpc/0/pfe/0/cm/0/MQSS(0)/0/MQSS_CMERROR_LI_INT_REG_UNROLL_TAIL_LENGTH_OVF (0x2205eb), scope: pfe, category: functional, severity: major, module: MQSS(0), type: LI: Unroll TAIL length overflow, oc_category: default fpc<#> Performing action reset-fru for error /fpc/0/pfe/0/cm/0/MQSS(0)/0/MQSS_CMERROR_LI_INT_REG_UNROLL_TAIL_LENGTH_OVF (0x2205eb) in module: MQSS(0) with scope: pfe category: functional level: major, oc_category: default This issue affects Junos OS on MX Series: * all versions before 23.2R2-S6, * 23.4 versions before 23.4R2-S7, * 24.2 versions before 24.2R2-S4, * 24.4 versions before 24.4R2-S4, * 25.2 versions before 25.2R2.
AI Analysis
Technical Summary
This vulnerability arises from improper validation of packet size in the Packet Forwarding Engine of Junos OS on MX Series devices. When a crafted packet is received from a device in the same broadcast domain, the system miscalculates the packet size, causing packet processing failures that trigger a major error in the Forwarding Plane Card (FPC). This error leads to an FPC reset, resulting in a temporary denial-of-service impacting network traffic. Affected traffic scenarios include MAP-T and non-IP traffic encapsulated in IP protocols such as MPLS over GRE. The vulnerability affects multiple Junos OS versions prior to specific fixed releases.
Potential Impact
An unauthenticated attacker within the same broadcast domain can cause a denial-of-service by triggering an FPC reset on affected Junos OS MX Series devices. This results in traffic disruption until the FPC automatically recovers. There is no impact on confidentiality or integrity reported. The vulnerability specifically affects packet forwarding and availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The affected versions are fixed starting from 23.2R2-S6, 23.4R2-S7, 24.2R2-S4, 24.4R2-S4, and 25.2R2. It is recommended to upgrade to these fixed versions once available. No other mitigation or workaround is specified in the provided data.
CVE-2026-57019: CWE-1284 Improper Validation of Specified Quantity in Input in Juniper Networks Junos OS
Description
An Improper Validation of Specified Quantity in Input vulnerability in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS on MX Series allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS). When a specific packet is received from device in the same broadcast domain, an affected system calculates the packet size incorrectly. This causes further packet processing to fail, which triggers an FPC major error, resulting in a FPC reset impacting traffic until the FPC has automatically recovered. Affected scenarios are: MAP-T, or non-IP traffic encapsulated in IP (e.g. MPLS over GRE). When this issue happens the following logs can be observed: fpc<#> CMError: /fpc/0/pfe/0/cm/0/MQSS(0)/0/MQSS_CMERROR_LI_INT_REG_UNROLL_TAIL_LENGTH_OVF (0x2205eb), scope: pfe, category: functional, severity: major, module: MQSS(0), type: LI: Unroll TAIL length overflow, oc_category: default fpc<#> Performing action reset-fru for error /fpc/0/pfe/0/cm/0/MQSS(0)/0/MQSS_CMERROR_LI_INT_REG_UNROLL_TAIL_LENGTH_OVF (0x2205eb) in module: MQSS(0) with scope: pfe category: functional level: major, oc_category: default This issue affects Junos OS on MX Series: * all versions before 23.2R2-S6, * 23.4 versions before 23.4R2-S7, * 24.2 versions before 24.2R2-S4, * 24.4 versions before 24.4R2-S4, * 25.2 versions before 25.2R2.
CVSS v3.1
Score 6.5medium
Affected software
pkg:github/juniper-networks/junos-osRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability arises from improper validation of packet size in the Packet Forwarding Engine of Junos OS on MX Series devices. When a crafted packet is received from a device in the same broadcast domain, the system miscalculates the packet size, causing packet processing failures that trigger a major error in the Forwarding Plane Card (FPC). This error leads to an FPC reset, resulting in a temporary denial-of-service impacting network traffic. Affected traffic scenarios include MAP-T and non-IP traffic encapsulated in IP protocols such as MPLS over GRE. The vulnerability affects multiple Junos OS versions prior to specific fixed releases.
Potential Impact
An unauthenticated attacker within the same broadcast domain can cause a denial-of-service by triggering an FPC reset on affected Junos OS MX Series devices. This results in traffic disruption until the FPC automatically recovers. There is no impact on confidentiality or integrity reported. The vulnerability specifically affects packet forwarding and availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The affected versions are fixed starting from 23.2R2-S6, 23.4R2-S7, 24.2R2-S4, 24.4R2-S4, and 25.2R2. It is recommended to upgrade to these fixed versions once available. No other mitigation or workaround is specified in the provided data.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- juniper
- Date Reserved
- 2026-06-23T16:27:00.248Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a50171468715ace431ea1a1
Added to database: 07/09/2026, 21:48:04 UTC
Last enriched: 07/17/2026, 09:58:31 UTC
Last updated: 08/22/2026, 22:52:14 UTC
Views: 72
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.