Vulnerability Details CVE-2026-57029
A Missing Synchronization vulnerability in the flow collector handler of Juniper Networks Junos OS Evolved on QFX Series allows an adjacent, unauthenticated attacker to cause a Denial-of-Service (DoS).
When the reachability of an sFlow collector changes, the corresponding next-hop entry is updated. If this update occurs simultaneously with the sFlow thread accessing the next-hop data (which is outside the attackers control), it causes the evo-pfemand process to crash, impacting all traffic forwarding until the automatic process restart has completed.
This issue affects Junos OS Evolved on QFX Series:
* all 23.2 versions,
* 23.4 versions before 23.4R2-S7-EVO,
* 24.2 versions before 24.2R2-S5-EVO,
* 24.4 versions before 24.4R2-S3-EVO,
* 25.2 versions before 25.2R2-EVO.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 8.8%
CVSS Severity
CVSS v3 Score 5.3
References
Products affected by CVE-2026-57029
-
cpe:2.3:h:juniper:qfx10016:-
-
cpe:2.3:h:juniper:qfx5120:-
-
cpe:2.3:h:juniper:qfx5130:-
-
cpe:2.3:h:juniper:qfx5140:-
-
cpe:2.3:h:juniper:qfx5200:-
-
cpe:2.3:h:juniper:qfx5210:-
-
cpe:2.3:h:juniper:qfx5220:-
-
cpe:2.3:h:juniper:qfx5230-64cd:-
-
cpe:2.3:h:juniper:qfx5240:-
-
cpe:2.3:h:juniper:qfx5241:-
-
cpe:2.3:h:juniper:qfx5250:-
-
cpe:2.3:h:juniper:qfx5700:-
-
cpe:2.3:o:juniper:junos_os_evolved:23.2
-
cpe:2.3:o:juniper:junos_os_evolved:23.4
-
cpe:2.3:o:juniper:junos_os_evolved:24.2
-
cpe:2.3:o:juniper:junos_os_evolved:24.4
-
cpe:2.3:o:juniper:junos_os_evolved:25.2