CVE-2026-57020: Juniper QFX10000 EVPN-VxLAN IPv6 Multicast DoS Vulnerability

Technical summary

CVE-2026-57020 is an improper exception handling vulnerability (CWE-754) in the Junos OS packet forwarding engine (PFE) on QFX10000 platforms. The flaw manifests specifically in EVPN-VxLAN deployments: when IPv6 multicast packets arrive at a non-IRB (Integrated Routing and Bridging) interface on a spine switch, the forwarding logic fails to prevent infinite packet loops. Packets are repeatedly forwarded between spine switches and all ESI (Ethernet Segment Identifier) leaf switches in the fabric, saturating interconnect bandwidth. The vulnerability is absent in Junos versions after 24.4, as QFX10000 hardware reached end-of-support in that release cycle.

Business impact

Organizations operating QFX10000-based EVPN-VxLAN fabrics face potential disruption to data center or service provider networks. An attacker can trigger widespread packet flooding that exhausts trunk capacity between fabric nodes, degrading performance for all tenant traffic traversing those links. In environments where QFX10000 serves as a spine or aggregation layer, the impact can cascade across multiple customer or service segments. Recovery typically requires manual intervention to isolate or reboot affected switches, resulting in service disruption and operational overhead.

Affected systems

Juniper Junos OS on QFX10000 Series devices in all versions prior to: 23.2R2-S7, 23.4R2-S8 (for 23.4 branch), 24.2R2-S4 (for 24.2 branch), and 24.4R2-S4 (for 24.4 branch). The vulnerability does not affect Junos versions after 24.4, as QFX10000 hardware is not supported on post-24.4 releases. Organizations running older or intermediate versions in EVPN-VxLAN topologies require immediate assessment.

Exploitability

Exploitability is straightforward from a technical standpoint. An attacker requires only adjacent network access (same Layer 2 segment or fabric access) and the ability to send IPv6 multicast traffic; no authentication or elevated privileges are needed. However, the attack is confined to environments where EVPN-VxLAN is actively configured and IPv6 multicast reaches a non-IRB spine interface—a specific architectural scenario. Public exploit code has not been disclosed, and the vulnerability is not currently tracked in CISA's KEV catalog.

Remediation

Upgrade affected QFX10000 devices to patched Junos versions: 23.2R2-S7 or later (23.2 branch), 23.4R2-S8 or later (23.4 branch), 24.2R2-S4 or later (24.2 branch), or 24.4R2-S4 or later (24.4 branch). For end-of-life deployments or interim risk reduction, implement network-based controls to restrict IPv6 multicast traffic at the fabric edge or disable IPv6 multicast on non-IRB spine interfaces if operationally feasible. Verify patch applicability against your specific Junos release train before deployment.

Patch guidance

Consult Juniper's security advisory for your specific Junos release branch. Patches are available in 23.2R2-S7, 23.4R2-S8, 24.2R2-S4, and 24.4R2-S4. Test patches in a staging fabric environment that mirrors your EVPN-VxLAN topology before production rollout. Stagger deployments across spine switches to avoid simultaneous fabric disruption during upgrade windows. Verify successful patching by confirming Junos version post-upgrade and monitoring multicast forwarding behavior under controlled IPv6 traffic injection.

Detection guidance

Monitor QFX10000 spine switches for excessive multicast packet replication and looping. Detection indicators include sustained high CPU or forwarding engine utilization on non-IRB interfaces coinciding with IPv6 multicast traffic ingress, and rapid growth in packet counters on ESI leaf uplinks without corresponding egress traffic. Enable per-interface packet loop detection and log anomalies. Network flow analytics should flag repeated IPv6 multicast frames arriving and departing the same interface in tight loops. Correlation with EVPN-VxLAN MAC/VNI tables will confirm the packet loop affects the vulnerable code path.

Why prioritize this

Although the CVSS score is 6.5 (Medium), organizations operating QFX10000 spines in production EVPN-VxLAN fabrics should prioritize remediation within 30–60 days. The attack surface is limited to adjacent network access and EVPN-VxLAN configurations, reducing urgency compared to remote DoS flaws; however, successful exploitation causes immediate fabric-wide congestion with operational impact. Delayed patching leaves the network vulnerable during any maintenance window or security incident when an insider or compromised edge device could trigger flooding. Prioritization should account for fabric criticality, EVPN-VxLAN deployment scope, and incident response capacity.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects a Medium-severity DoS attack vector with adjacent-only access, low complexity, no authentication, and high availability impact. The attack does not compromise confidentiality or integrity, limiting the score below High threshold. However, the score does not discount the concentration of risk in data center fabric scenarios where a single spine failure cascades broadly. In critical service provider or hyperscale environments, operational risk may exceed the numerical score; security teams should adjust prioritization based on business context and network architecture.

Frequently asked questions