CVE-2026-57019: Juniper MX Junos OS Denial-of-Service via Improper Packet Validation

Technical summary

CVE-2026-57019 is an improper input validation flaw in the Packet Forwarding Engine (PFE) of Juniper Junos OS affecting MX Series routers. The vulnerability exists in how the system calculates packet size when processing MAP-T traffic or non-IP protocols tunneled over IP (such as MPLS over GRE). When a malformed packet matching these conditions is received from an adjacent device, the calculation error propagates through packet processing logic in the Modular Queue Scheduler (MQSS) component, triggering an integer overflow condition (LI_INT_REG_UNROLL_TAIL_LENGTH_OVF) that forces an FPC reset. The root cause is insufficient bounds checking on packet size inputs before they are used in downstream processing operations.

Business impact

Availability impact is the primary concern. A successful attack causes an FPC to reset, interrupting all traffic handled by that line card until automatic recovery completes. In a multi-FPC router, this affects a subset of bandwidth; in single-FPC deployments, it could cause significant service disruption. Organizations relying on Junos MX platforms for critical forwarding should assess whether an adversary on their network perimeter or in a shared broadcast domain (ISP interconnect, MPLS network, or campus LAN) could repeatedly trigger this condition to sustain a denial-of-service.

Affected systems

All versions of Juniper Junos OS on MX Series routers are vulnerable unless patched. Specifically: all versions before 23.2R2-S6, versions 23.4 before 23.4R2-S7, versions 24.2 before 24.2R2-S4, versions 24.4 before 24.4R2-S4, and versions 25.2 before 25.2R2. Any MX Series deployment (MX10, MX40, MX80, MX104, MX240, MX480, MX960 families) running an older OS build falls into scope.

Exploitability

Exploitability is moderate but practically constrained. The attacker must be adjacent (same broadcast domain), possess no credentials, and trigger only via packet reception. However, weaponization requires crafting specific MAP-T or MPLS-over-GRE packets that hit the vulnerable code path; generic packet fuzzing is unlikely to surface the condition. The CVSS 3.1 score of 6.5 (MEDIUM) reflects the adjacent-only attack vector and the need for specific traffic types. Public exploit code does not appear to be in active circulation. Attacker motivation is limited to disruption rather than data theft or unauthorized access.

Remediation

Upgrade affected MX Series systems to patched versions: 23.2R2-S6 or later, 23.4R2-S7 or later, 24.2R2-S4 or later, 24.4R2-S4 or later, or 25.2R2 or later. Organizations should verify their current Junos build via 'request shell' and 'show version' commands, then schedule updates during a maintenance window. Juniper's advisory should be consulted for any version-specific upgrade guidance or interim workarounds if patching cannot be deployed immediately.

Patch guidance

Identify your current Junos version (run 'show version' on the affected router). Cross-reference against the vulnerable range for your major version branch. Patch versions are: 23.2R2-S6+, 23.4R2-S7+, 24.2R2-S4+, 24.4R2-S4+, 25.2R2+. Plan a maintenance window; FPC reset during patching may occur as the OS loads new firmware. Test the patched image on a non-production MX first if possible. Juniper's advisory and release notes should document any breaking changes or dependencies tied to your specific version path.

Detection guidance

Monitor system logs for the characteristic MQSS error message: 'MQSS_CMERROR_LI_INT_REG_UNROLL_TAIL_LENGTH_OVF' (error code 0x2205eb). This error, coupled with a subsequent 'Performing action reset-fru' entry, indicates a successful trigger. Enable extended logging on the PFE to capture the timing and source of offending packets if the attack persists. While logging does not prevent the DoS, it aids in identifying the attack source and verifying mitigation. Consider capturing inbound traffic on affected interfaces during an incident to analyze packet structures that triggered the reset.

Why prioritize this

This vulnerability merits timely but not emergency patching for most organizations. The MEDIUM severity, requirement for adjacent network access, and absence of active exploitation currently in the wild allow for scheduled remediation. However, operators managing MX platforms at critical network edges (ISP peering, major branch interconnection) or in untrusted network environments should deprioritize higher-severity issues only where risk justifies accelerated patching. Organizations in closed, well-controlled networks face lower urgency; those exposing MX devices to third-party traffic or running older major versions should move this to the front of the queue.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects a MEDIUM severity assessment. Attack Vector (Adjacent) limits reach, as the attacker must share a broadcast domain; this is less severe than network-reachable vulnerabilities. Attack Complexity (Low) and lack of privilege/user interaction increase the threat. Availability Impact (High) is the only impact dimension, but no confidentiality or integrity loss occurs. The score appropriately captures that this is a local network DoS rather than a widespread, remotely exploitable compromise. Organizations should note that impact severity (FPC reset and traffic loss) may be higher in specific operational contexts, warranting elevated internal risk scoring for critical infrastructure.

Frequently asked questions