Executive brief
A vulnerability in Juniper Networks Junos OS Evolved on QFX Series switches can cause a complete system crash and stop all network traffic forwarding. This occurs when the system attempts to update network routing information at the same time it is monitoring traffic flows. An attacker on the local network could trigger this condition, leading to a service outage until the system automatically restarts.
Technical details
A Missing Synchronization (CWE-820) vulnerability exists in the flow collector handler of Juniper Networks Junos OS Evolved on QFX Series. The issue is triggered when the reachability of an sFlow collector changes, causing a next-hop entry update to occur simultaneously with the sFlow thread accessing that same data. This race condition leads to a crash of the 'evo-pfemand' process. While the timing of the crash is outside the attacker's direct control, an adjacent unauthenticated attacker can trigger the underlying reachability changes. The crash impacts all traffic forwarding until the process automatically restarts. Patches are available in versions 23.4R2-S7-EVO, 24.2R2-S5-EVO, 24.4R2-S3-EVO, and 25.2R2-EVO.
Affected products
- Juniper Networks Junos OS Evolved 23.2, 23.4 before 23.4R2-S7-EVO, 24.2 before 24.2R2-S5-EVO, 24.4 before 24.4R2-S3-EVO, 25.2 before 25.2R2-EVO
Timeline
- 2026-07-09: advisory: Initial publication of JSA110089