Junos OS (SRX firewalls)
CVE-2026-33780: In an EVPN-MPLS scenario churn of ESI routes causes a memory leak in l2ald
A Missing Release of Memory after Effective Lifetime vulnerability in the Layer 2 Address Learning Daemon (l2ald) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated attacker to cause a memory leak ultimately leading to a Denial of Service (DoS).
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Junos OS 0 | 22.4R3-S5 or later |
| Junos OS 23.2 | 23.2R2-S3 or later |
| Junos OS 23.4 | 23.4R2-S4 or later |
| Junos OS 24.2 | 24.2R2 or later |
| Junos OS Evolved all version prior to | 22.4R3-S5-EVO or later |
| Junos OS Evolved 23.2 | 23.2R2-S3-EVO or later |
| Junos OS Evolved 23.4 | 23.4R2-S4-EVO or later |
| Junos OS Evolved 24.2 | 24.2R2-EVO or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
A Missing Release of Memory after Effective Lifetime vulnerability in the Layer 2 Address Learning Daemon (l2ald) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated attacker to cause a memory leak ultimately leading to a Denial of Service (DoS).
In an EVPN-MPLS scenario, routes learned from remote multi-homed Provider Edge (PE) devices are programmed as ESI routes. Due to a logic issue in the l2ald memory management, memory allocated for these routes is not released when there is churn for these routes. As a result, memory leaks in the l2ald process which will ultimately lead to a crash and restart of l2ald.
Use the following command to monitor the memory consumption by l2ald:
user@device> show system process extensive | match "PID|l2ald"
This issue affects:
Junos OS:
- all versions before 22.4R3-S5,
- 23.2 versions before 23.2R2-S3,
- 23.4 versions before 23.4R2-S4,
- 24.2 versions before 24.2R2;
Junos OS Evolved:
- all versions before 22.4R3-S5-EVO,
- 23.2 versions before 23.2R2-S3-EVO,
- 23.4 versions before 23.4R2-S4-EVO,
- 24.2 versions before 24.2R2-EVO.
Am I affected?
To be exposed to this issue the device must be configured for EVPN-MPLS. Refer to product documentation for how to configure EVPN-MPLS as there are different configuration options.
Workarounds
There are no known workarounds for this issue.
Exploitation
Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.