SB2026070869 - Denial of service in Junos OS Evolved

Description

This security bulletin contains information about 1 vulnerability.

1) Race condition (CVE-ID: CVE-2026-57029)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to missing synchronization in the flow collector handler when handling changes in sFlow collector reachability. A remote attacker can trigger reachability changes to cause a denial of service.

At least one sFlow collector must be configured for the issue to be exposed, and the crash impacts traffic forwarding until the automatic process restart completes.

Remediation

Install update from vendor's website.

References

• https://supportportal.juniper.net/s/article/2026-07-Security-Bulletin-Junos-OS-Evolved-QFX-Series-When-sFlow-collector-reachability-changes-evo-pfemand-process-can-crash-CVE-2026-57029
• https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H