CVE-2026-101994
7.1HighPublished 14 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-130
Impact
An adjacent attacker impersonating or controlling an MC-LAG ICCP peer can crash the l2ald daemon or read process heap memory. They require layer 2/adjacent network access to the inter-chassis control plane.
Root cause
The l2ald daemon improperly handles length parameter inconsistencies when processing malformed ICCP messages.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Fix & remediation
Upgrade Junos OS and Junos OS Evolved to the fixed releases specified in JSA112187. As an interim workaround, restrict or authenticate ICCP traffic and isolate the inter-chassis link between MC-LAG peers.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
An Improper Handling of Length Parameter Inconsistency vulnerability in the l2ald daemon of Juniper Networks Junos OS and Junos OS Evolved allows an attacker who can control or impersonate a configured MC-LAG ICCP peer to disclose process heap memory or cause a denial of service via a malformed ICCP message.