CVE-2026-33800: Juniper MX Series Denial-of-Service via BFD Session Flapping

Technical summary

The Packet Forwarding Engine Manager (PFEMAN) in Junos OS processes state-change events generated by Micro-BFD session flaps. Under Virtual-Chassis configurations with locality-bias enabled, each event incurs significant processing overhead. An attacker can generate rapid Micro-BFD session state transitions, continuously queueing new events faster than PFEMAN can drain the queue. Because the loop condition is not properly bounded or throttled, PFEMAN never reaches a quiescent state. The watchdog timer protecting the FPC eventually expires due to resource exhaustion, triggering an FPC crash and restart. This is classified as CWE-606 (Unchecked Input for Loop Condition).

Business impact

An adjacent attacker can achieve complete denial of service on affected MX Series routers without credentials or user interaction. In production environments, this translates to immediate traffic loss on the compromised FPC, potentially affecting millions of packets per second depending on the router's role. For service providers or large enterprises running MX routers as core or edge devices, this vulnerability can cascade into significant network outages. Recovery requires manual intervention to restart the FPC or reboot the entire chassis.

Affected systems

Junos OS on MX Series is affected across multiple versions: all releases before 23.2R2-S7, 23.4 versions before 23.4R2-S8, 24.2 versions before 24.2R2-S4, 24.4 versions before 24.4R2-S3, and 25.2 versions before 25.2R2. The vulnerability is limited to older forwarding hardware: MPC9 and earlier, LC2101, LC2103, and LC480. Modern line cards including MPC10, MPC11, LC4800, LC9600, and MX304 are unaffected. Organizations should verify their exact MX hardware and Junos OS version against Juniper's advisory.

Exploitability

This vulnerability is straightforward to trigger from the adjacent network segment. No authentication is required, and the attack is passive from the attacker's perspective—manipulating Micro-BFD state requires only crafted Layer 2 or Layer 3 traffic to the router's BFD endpoints. The CVSS score of 6.5 (Medium) reflects the requirement for network adjacency and the impact limited to availability. However, the practical ease of exploitation and severity of impact (total FPC outage) make this a high-priority issue despite the medium severity rating.

Remediation

Juniper has released patched versions for all affected release trains. Organizations should upgrade to 23.2R2-S7 or later in the 23.2 train, 23.4R2-S8 or later in 23.4, 24.2R2-S4 or later in 24.2, 24.4R2-S3 or later in 24.4, or 25.2R2 or later in 25.2. Verify these patch versions against Juniper's official security advisory before deployment. Until patching is complete, access controls limiting BFD traffic from untrusted adjacent networks provide temporary mitigation.

Patch guidance

Determine your current Junos OS version and MX hardware model using 'show version' and 'show chassis routing-engine'. Cross-reference against the affected versions and hardware list in the vulnerability description. If affected, plan an upgrade to the nearest patched version in your release train. Verify the exact patch version in Juniper's advisory to ensure you select the correct build. Test the upgrade in a lab environment first, as Junos updates may require careful orchestration in Virtual-Chassis setups. Schedule maintenance windows to minimize impact, and ensure out-of-band management access is available during the upgrade.

Detection guidance

Monitor for FPC crashes and restarts using syslog alerts from the router's Packet Forwarding Engine. Look for watchdog timer expiration messages and correlations with Micro-BFD session flapping on adjacent network segments. If you operate a network tap or packet broker, capture traffic patterns showing rapid BFD state changes originating from a specific source MAC or IP address targeting your router's BFD endpoints. Baseline your normal Micro-BFD flap rates and alert on anomalous spikes, particularly in Virtual-Chassis topologies with locality-bias enabled.

Why prioritize this

Although the CVSS score is Medium (6.5), the practical severity warrants higher prioritization. An unauthenticated adjacent attacker can trivially cause a complete outage affecting potentially thousands of users or customers. The attack leaves minimal forensic traces and requires only basic network access. Organizations with MX routers in core or peering positions should prioritize patching within days rather than weeks. Even if your router is not directly exposed to untrusted networks, consider the risk from compromised internal hosts or supply-chain compromises on adjacent segments.

Risk score, explained

CVSS 6.5 reflects the attack vector (Adjacent Network only), low complexity, no privileges required, no user interaction, and high availability impact. However, this scoring underweights the ease and stealth of exploitation in production networks. The vulnerability becomes critical in scenarios where MX routers peer with untrusted or less-trusted AS neighbors, or where internal network segmentation is weak. Adjust your internal risk rating upward if your MX deployment includes these factors.

Frequently asked questions