Home

Description

A Missing Synchronization vulnerability in the flow collector handler of Juniper Networks Junos OS Evolved on QFX Series allows an adjacent, unauthenticated attacker to cause a Denial-of-Service (DoS). When the reachability of an sFlow collector changes, the corresponding next-hop entry is updated. If this update occurs simultaneously with the sFlow thread accessing the next-hop data (which is outside the attackers control), it causes the evo-pfemand process to crash, impacting all traffic forwarding until the automatic process restart has completed. This issue affects Junos OS Evolved on QFX Series: * all 23.2 versions, * 23.4 versions before 23.4R2-S7-EVO, * 24.2 versions before 24.2R2-S5-EVO, * 24.4 versions before 24.4R2-S3-EVO, * 25.2 versions before 25.2R2-EVO.

PUBLISHED Reserved 2026-06-23 | Published 2026-07-09 | Updated 2026-07-10 | Assigner juniper




MEDIUM: 5.3CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

MEDIUM: 6.0CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/RE:M

Problem types

CWE-820 Missing Synchronization

Product status

Default status
unaffected

Any version before 23.4R2-S7-EVO
affected

24.2 (custom) before 24.2R2-S5-EVO
affected

24.4 (custom) before 24.4R2-S3-EVO
affected

25.2 (custom) before 25.2R2-EVO
affected

References

supportportal.juniper.net/JSA110089 vendor-advisory

cve.org (CVE-2026-57029)

nvd.nist.gov (CVE-2026-57029)

Download JSON