CVE-2026-57027 Junos OS: EX4100 Series, EX4400: With sFlow configured in a VC scenario multicast traffic leads to an FPC crash
An unauthenticated adjacent attacker can cause a denial of service by triggering a memory leak in sFlow-enabled Virtual Chassis multicast traffic.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-57027?
CVE-2026-57027 is a high-severity denial of service vulnerability in Juniper Junos, published on 9 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A Missing Release of Memory after Effective Lifetime vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on specific EX Series devices allows an unauthenticated adjacent attacker to cause a Denial-of-Service (DoS).When sFlow is configured in a Virtual Chassis (VC) scenario with EX4100 Series or EX4400 Series devices, multicast traffic which is received on one VC member and sent out on another member leads to a memory leak and ultimately an FPC crash and restart.
The leak can be monitored by watching the continuous increase of the buffer values in the output of:
user@host> show chassis fpc This issue affects Junos OS on EX4100 Series and EX4400:
* all versions before 23.2R2-S7, * 23.4 versions before 23.4R2-S7, * 24.2 versions before 24.2R2-S4, * 24.4 versions before 24.4R2.
Weakness: CWE-401
Which versions are affected by CVE-2026-57027?
It affects 1 product.
Products include Juniper Junos.
How do I fix CVE-2026-57027?
No fix has been published for CVE-2026-57027 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-57027 being exploited?
There is no known exploitation of CVE-2026-57027 in the wild and no public exploit code.
Other vulnerabilities in Juniper Junos
- CVE-2023-36845 Juniper Junos OS EX Series and SRX Series PHP External Variable Modification
- CVE-2020-1631 Juniper Junos OS Path Traversal
- CVE-2025-21590 Juniper Junos OS Improper Isolation or Compartmentalization
- CVE-2023-36851 Juniper Junos OS SRX Series Missing Authentication for Critical Function
- CVE-2023-36844 Juniper Junos OS EX Series PHP External Variable Modification
Sources
Also known as GHSA-2xj6-hwhm-5m6g.