CVE-2026-33781 Details
Description
An Improper Check for Unusual or Exceptional Conditions vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on specific EX and QFX Series devices allow an unauthenticated, adjacent attacker to cause a complete Denial of Service (DoS). On EX4k, and QFX5k platforms configured as service-provider edge devices, if L2PT is enabled on the UNI and VSTP is enabled on NNI in VXLAN scenarios, receiving VSTP BPDUs on UNI leads to packet buffer allocation failures, resulting in the device to not pass traffic anymore until it is manually recovered with a restart.This issue affects Junos OS: * 24.4 releases before 24.4R2, * 25.2 releases before 25.2R1-S1, 25.2R2. This issue does not affect Junos OS releases before 24.4R1.
A denial-of-service vulnerability has been identified in Juniper Networks Junos OS, specifically on certain EX and QFX Series devices. This issue arises in the packet forwarding engine (PFE) when the Layer 2 Protocol Tunneling (L2PT) is enabled on User Network Interface (UNI) and the Virtual Spanning Tree Protocol (VSTP) is active on Network-to-Network Interface (NNI) in Virtual Extensible LAN (VXLAN) scenarios. Under these conditions, receiving VSTP Bridge Protocol Data Units (BPDUs) on the UNI can lead to packet buffer allocation failures. As a result, the device stops passing traffic until it is manually restarted. The vulnerability affects Junos OS versions 24.4 prior to 24.4R2 and 25.2 prior to 25.2R1-S1 and 25.2R2. Devices running Junos OS releases before 24.4R1 are not affected.
Users can upgrade to Junos OS versions 24.4R2, 25.2R1-S1, 25.2R2, 25.4R1, or any subsequent release. Alternatively, to prevent VSTP BPDUs from being processed on UNI interfaces, configure the BPDU block protocol to drop BPDUs on all UNI interfaces.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://kb.juniper.net/JSA107869 | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-754 | Improper Check for Unusual or Exceptional Conditions | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| juniper junos | 24.4 - 24.4 r1 24.4 r1-s2 24.4 r1-s3 25.2 - 25.2 r1 25.2 r2 |
CPE
Remediation
| |
| juniper ex4000 | All versions |
CPE
Remediation
| |
| juniper ex4100 | All versions |
CPE
Remediation
| |
| juniper ex4100-f | All versions |
CPE
Remediation
| |
| juniper ex4100-h | All versions |
CPE
Remediation
| |
| juniper ex4300 | All versions |
CPE
Remediation
| |
| juniper ex4400 | All versions |
CPE
Remediation
| |
| juniper ex4600 | All versions |
CPE
Remediation
| |
| juniper ex4650 | All versions |
CPE
Remediation
| |
| juniper qfx5110 | All versions |
CPE
Remediation
| |
| juniper qfx5120 | All versions |
CPE
Remediation
| |
| juniper qfx5130 | All versions |
CPE
Remediation
| |
| juniper qfx5200 | All versions |
CPE
Remediation
| |
| juniper qfx5210 | All versions |
CPE
Remediation
| |
| juniper qfx5220 | All versions |
CPE
Remediation
| |
| juniper qfx5230-64cd | All versions |
CPE
Remediation
| |
| juniper qfx5240 | All versions |
CPE
Remediation
| |
| juniper qfx5241 | All versions |
CPE
Remediation
| |
| juniper qfx5700 | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 17, 2026 | Initial Analysis | [email protected] |
| Apr 9, 2026 | New CVE Received | [email protected] |