Vulnerability · Published Oct 14, 2026 · Assigned by juniper

CVE-2026-102048Junos OS: An attacker causes l2cpd crash when FNP is used with VLAN-VPLS encapsulation enabled

Medium 6.5

In plain English

A medium-severity resource allocation without limits in Junos OS from Juniper Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 81.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An Allocation of Resources Without Limits or Throttling vulnerability in the l2cpd process of Juniper Networks Junos OS allows an adjacent unauthenticated attacker to cause a denial of service and l2cpd restart via FNP-enabled Layer 2 interfaces. The issue is triggered when the FNP feature is enabled on a VPLS routing instance with VLAN-VPLS encapsulation enabled. This issue affects all platforms except the PTX Series and SRX Series.

Affected products (as reported)

Vendor	Product	Versions
Juniper Networks	Junos OS	0 – before 23.2R2-S7.723.4 – before 23.4R2-S8.1324.2 – before 24.2R2-S5.524.4 – before 24.4R2-S525.2 – before 25.2R2-S225.4 – before 25.4R1-S326.2 – before 26.2R1-S2

Weakness: CWE-770 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://supportportal.juniper.net/JSA112188 vendor-advisory