Junos OS (SRX firewalls)
CVE-2026-102048: An attacker causes l2cpd crash when FNP is used with VLAN-VPLS encapsulation enabled
An Allocation of Resources Without Limits or Throttling vulnerability in the l2cpd process of Juniper Networks Junos OS allows an adjacent unauthenticated attacker to cause a denial of service and l2cpd restart via FNP-enabled Layer 2 interfaces.
Published Juniper Networks advisory JSA112188
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Junos OS 0 | 23.2R2-S7.7 or later |
| Junos OS 23.4 | 23.4R2-S8.13 or later |
| Junos OS 24.2 | 24.2R2-S5.5 or later |
| Junos OS 24.4 | 24.4R2-S5 or later |
| Junos OS 25.2 | 25.2R2-S2 or later |
| Junos OS 25.4 | 25.4R1-S3 or later |
| Junos OS 26.2 | 26.2R1-S2 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
In short
An unauthenticated attacker on an adjacent network can trigger a denial of service by sending traffic to a VPLS routing instance with FNP and VLAN-VPLS encapsulation enabled. This causes the l2cpd process to restart, disrupting network services. The vulnerability exists because the system does not limit resource allocation for these specific Layer 2 interface configurations.
Written by a language model from the vendor's description. Versions, fixes and exploitation status on this page come straight from the vendor and CISA.
The vendor's description
An Allocation of Resources Without Limits or Throttling vulnerability in the l2cpd process of Juniper Networks Junos OS allows an adjacent unauthenticated attacker to cause a denial of service and l2cpd restart via FNP-enabled Layer 2 interfaces. The issue is triggered when the FNP feature is enabled on a VPLS routing instance with VLAN-VPLS encapsulation enabled.
This issue affects all platforms except the PTX Series and SRX Series.
Am I affected?
[ interfaces <interface> flexible-vlan-tagging encapsulation flexible-ethernet-services ] [ interfaces <interface> unit <unit> encapsulation vlan-vpls vlan-id <id> ] [ protocols oam ethernet fnp interface <interface>.<id> ]
Workarounds
There are no known workarounds for this issue.
Exploitation
Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 19 Oct 2026.