CVE-2026-57029: Juniper Junos OS Evolved QFX DoS via sFlow Synchronization Race Condition

Technical summary

CVE-2026-57029 is a missing synchronization vulnerability (CWE-820) in the sFlow collector handler within Junos OS Evolved on QFX Series devices. The root cause is a race condition: when the reachability state of an sFlow collector changes, the corresponding next-hop entry is updated. If this update occurs concurrently with an sFlow thread reading the same next-hop data structure, unsynchronized access leads to a crash of the evo-pfemand process. The attacker's role is to indirectly influence collector reachability transitions; the actual timing of the crash depends on thread scheduling, making this a high-complexity exploit despite unauthenticated, adjacent-only access. The CVSS 3.1 score of 5.3 (MEDIUM) reflects high availability impact but local network requirement and high complexity.

Business impact

Organizations relying on QFX Series switches for core or edge routing face intermittent packet forwarding outages if an attacker can repeatedly trigger collector reachability changes. Each crash forces a process restart that can last seconds to minutes depending on system load, during which all traffic handled by that fabric element is dropped. For cloud providers, ISPs, and large enterprises using QFX platforms for sFlow-based telemetry, this creates a denial-of-service attack surface that can disrupt monitoring infrastructure and, more critically, transit traffic if the affected switch carries production flows. The attack requires only adjacent network access, lowering the barrier compared to remote exploitation vectors.

Affected systems

All versions of Junos OS Evolved 23.2 on QFX Series are vulnerable. Junos OS Evolved 23.4 versions prior to 23.4R2-S7-EVO, 24.2 versions prior to 24.2R2-S5-EVO, 24.4 versions prior to 24.4R2-S3-EVO, and 25.2 versions prior to 25.2R2-EVO are also impacted. Vulnerable hardware includes the QFX10008, QFX10016, QFX5110, QFX5120, QFX5130, QFX5140, QFX5200, QFX5210, and QFX5220. Organizations running older or unpatched versions of Junos OS Evolved on these platforms should prioritize inventory checks and version audits immediately.

Exploitability

Exploitation requires adjacent network access—the attacker must reside on the same local network segment as the QFX switch or sFlow collector. Authentication is not required. The attacker triggers the vulnerability by manipulating sFlow collector reachability, forcing state transitions that create a narrow race condition window. While the attack is unauthenticated and the attack surface is within reach of network neighbors, the race condition's inherent timing uncertainty makes exploitation probabilistic and not reliably weaponizable. This is reflected in the CVSS AC:H (high complexity) rating. However, repeated attempts over time increase the likelihood of successful crashes, making this a practical DoS vector for determined adjacent attackers.

Remediation

Juniper has released patched versions for all affected branches: upgrade to Junos OS Evolved 23.4R2-S7-EVO or later for the 23.4 branch, 24.2R2-S5-EVO or later for 24.2, 24.4R2-S3-EVO or later for 24.4, and 25.2R2-EVO or later for 25.2. Version 23.2 has no patched release and should be upgraded to a supported, patched version such as 23.4R2-S7-EVO or newer. Verification of patch deployment is critical because unpatched systems remain exposed to simple, repeatable DoS attacks. Test patches in a pre-production environment before production rollout to ensure compatibility with existing sFlow configurations and network policies.

Patch guidance

Before patching, validate the current Junos OS Evolved version using 'request shell' and 'cat /etc/os-release' or via the CLI 'show version'. Download patches from Juniper's support portal and stage them in the switch's boot partition. Execute the upgrade using 'request system software in-service-upgrade /path/to/patch' to minimize downtime. Verify post-upgrade that sFlow collectors are reachable and that the evo-pfemand process is stable by monitoring 'show system processes extensive | grep evo-pfemand'. Schedule patching during maintenance windows if possible, as in-service upgrades may still cause brief traffic disruptions. For mission-critical deployments, coordinate patching across fabric pairs to maintain redundancy.

Detection guidance

Monitor for unexpected restarts of the evo-pfemand process on QFX Series switches, particularly in correlation with sFlow collector reachability changes. Enable Junos OS logging for process crashes: 'set system syslog file messages any; set system syslog file messages emergency'. Check system logs for 'evo-pfemand exited' messages or core dumps. Implement NetFlow or sFlow telemetry monitoring to detect sudden traffic loss events that correlate with process restarts. Additionally, track sFlow collector connectivity changes via SNMP traps or CLI monitoring; repeated collector state flaps combined with process crashes are a strong indicator of exploitation attempts. Network-based intrusion detection should flag unusual patterns of sFlow collector connectivity transitions originating from a single adjacent host.

Why prioritize this

This vulnerability warrants immediate attention for organizations operating QFX Series switches, particularly those exposed to untrusted adjacent networks (e.g., data center leaf-spine fabrics, service provider edge). The vulnerability affects all 23.2 versions with no patch path, forcing an upgrade to newer major versions for those deployments. The race condition's probabilistic nature and the requirement for adjacent access lower the CVSS score to MEDIUM, but the combination of zero authentication, predictable impact (complete process crash), and the centrality of packet forwarding hardware in network infrastructure makes this a practical and high-value target. Organizations should treat this as a 'patch soon' issue within the next 30 days unless adjacent network access is strictly controlled.

Risk score, explained

The CVSS 3.1 score of 5.3 (MEDIUM) reflects: unauthenticated adjacent access (AV:A, no authentication required), high complexity due to the race condition timing (AC:H), no confidentiality or integrity impact (C:N, I:N), and high availability impact (A:H). The 'adjacent' vector limits attack surface compared to remotely exploitable flaws, but the absence of authentication and the deterministic denial of service keep the score in the MEDIUM range rather than LOW. For a network-critical infrastructure component like a QFX switch, organizations should consider their risk tolerance for even a MEDIUM-scored availability impact and prioritize accordingly.

Frequently asked questions