CVE-2026-57029

EPSS 0.12%
Veröffentlicht 09.07.2026 21:12:36
Zuletzt bearbeitet 13.07.2026 20:23:46
Erkennungen
Login

Junos OS Evolved: QFX Series: When sFlow collector reachability changes evo-pfemand process can crash

A Missing Synchronization vulnerability in the flow collector handler of Juniper Networks Junos OS Evolved on QFX Series allows an adjacent, unauthenticated attacker to cause a Denial-of-Service (DoS).


When the reachability of an sFlow collector changes, the corresponding next-hop entry is updated. If this update occurs simultaneously with the sFlow thread accessing the next-hop data (which is outside the attackers control), it causes the evo-pfemand process to crash, impacting all traffic forwarding until the automatic process restart has completed.




This issue affects Junos OS Evolved on QFX Series:


  *  all 23.2 versions, 
  *  23.4 versions before 23.4R2-S7-EVO,
  *  24.2 versions before 24.2R2-S5-EVO,
  *  24.4 versions before 24.4R2-S3-EVO,
  *  25.2 versions before 25.2R2-EVO.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 4

NVD 31 VulnDex Vulnerability Enrichment 1

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Juniper ≫ Junos Os Evolved Version 23.2

   Juniper ≫ Qfx10008 Version -
   Juniper ≫ Qfx10016 Version -
   Juniper ≫ Qfx5110 Version -
   Juniper ≫ Qfx5120 Version -
   Juniper ≫ Qfx5130 Version -
   Juniper ≫ Qfx5140 Version -
   Juniper ≫ Qfx5200 Version -
   Juniper ≫ Qfx5210 Version -
   Juniper ≫ Qfx5220 Version -
   Juniper ≫ Qfx5230-64cd Version -
   Juniper ≫ Qfx5240 Version -
   Juniper ≫ Qfx5241 Version -
   Juniper ≫ Qfx5250 Version -
   Juniper ≫ Qfx5700 Version -

Juniper ≫ Junos Os Evolved Version 23.4 Update -

Juniper ≫ Junos Os Evolved Version 23.4 Update r1

Juniper ≫ Junos Os Evolved Version 23.4 Update r1-s1

Juniper ≫ Junos Os Evolved Version 23.4 Update r1-s2

Juniper ≫ Junos Os Evolved Version 23.4 Update r2

Juniper ≫ Junos Os Evolved Version 23.4 Update r2-s1

Juniper ≫ Junos Os Evolved Version 23.4 Update r2-s2

Juniper ≫ Junos Os Evolved Version 23.4 Update r2-s3

Juniper ≫ Junos Os Evolved Version 23.4 Update r2-s4

Juniper ≫ Junos Os Evolved Version 23.4 Update r2-s5

Juniper ≫ Junos Os Evolved Version 23.4 Update r2-s6

Juniper ≫ Junos Os Evolved Version 24.2 Update -

Juniper ≫ Junos Os Evolved Version 24.2 Update r1

Juniper ≫ Junos Os Evolved Version 24.2 Update r1-s2

Juniper ≫ Junos Os Evolved Version 24.2 Update r2

Juniper ≫ Junos Os Evolved Version 24.2 Update r2-s1

Juniper ≫ Junos Os Evolved Version 24.2 Update r2-s2

Juniper ≫ Junos Os Evolved Version 24.2 Update r2-s3

Juniper ≫ Junos Os Evolved Version 24.2 Update r2-s4

Juniper ≫ Junos Os Evolved Version 24.4 Update -

Juniper ≫ Junos Os Evolved Version 24.4 Update r1

Juniper ≫ Junos Os Evolved Version 24.4 Update r1-s2

Juniper ≫ Junos Os Evolved Version 24.4 Update r1-s3

Juniper ≫ Junos Os Evolved Version 24.4 Update r2

Juniper ≫ Junos Os Evolved Version 24.4 Update r2-s1

Juniper ≫ Junos Os Evolved Version 24.4 Update r2-s2

Juniper ≫ Junos Os Evolved Version 25.2 Update -

Juniper ≫ Junos Os Evolved Version 25.2 Update r1

Juniper ≫ Junos Os Evolved Version 25.2 Update r1-s1

Juniper ≫ Junos Os Evolved Version 25.2 Update r1-s2

VulnDex Vulnerability Enrichment

Diese Information steht angemeldeten Benutzern zur Verfügung.

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.12%	0.022

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
Juniper	6	0	0	CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:M/U:X
Juniper	5.3	1.6	3.6	CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-820 Missing Synchronization

The product utilizes a shared resource in a concurrent manner but does not attempt to synchronize access to the resource.

https://supportportal.juniper.net/JSA110089

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2026-57029

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2026-57029

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2026-57029

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2026-57029