CVE-2026-21903: Juniper Junos OS DoS Vulnerability

CVE-2026-21903 Overview

A Stack-based Buffer Overflow vulnerability has been identified in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS. This vulnerability allows a network-based attacker with low-level authentication to cause a Denial-of-Service (DoS) condition on affected devices.

The vulnerability is triggered when subscribing to telemetry sensors at scale, which causes all Flexible PIC Concentrator (FPC) connections to drop. This results in an FPC crash and subsequent restart, disrupting network operations. Notably, the issue was not observed when YANG packages for the specific sensors were installed, suggesting a workaround path for affected organizations.

Critical Impact

Network-based attackers with low privileges can crash the Packet Forwarding Engine, causing complete service disruption and requiring device restart. This poses significant risk to network availability and infrastructure stability.

Affected Products

• Juniper Networks Junos OS all versions before 22.4R3-S7
• Juniper Networks Junos OS 23.2 versions before 23.2R2-S4
• Juniper Networks Junos OS 23.4 versions before 23.4R2

Discovery Timeline

• 2026-01-15 - CVE-2026-21903 published to NVD
• 2026-01-16 - Last updated in NVD database

Technical Details for CVE-2026-21903

Vulnerability Analysis

This vulnerability is classified as CWE-121 (Stack-based Buffer Overflow), a memory corruption flaw that occurs when data written to a buffer on the stack exceeds its allocated size. In the context of Junos OS, this overflow occurs within the Packet Forwarding Engine component when processing telemetry sensor subscriptions at scale.

The Packet Forwarding Engine is a critical component responsible for forwarding packets through Juniper routers and switches. When this component crashes, all packet forwarding operations cease until the FPC restarts, causing significant network disruption.

The attack requires network access and low-level authentication, making it accessible to authenticated users or compromised accounts within the network. The primary impact is on availability, with no direct effect on confidentiality or integrity of the system.

Root Cause

The root cause stems from improper bounds checking in the telemetry sensor subscription handling code within the Packet Forwarding Engine. When a large number of telemetry sensor subscriptions are processed simultaneously, the stack buffer allocated for this operation is insufficient to handle the data volume, leading to a buffer overflow condition.

The absence of this issue when YANG packages for specific sensors are installed suggests that the YANG package implementation includes proper bounds checking or alternative memory allocation strategies that prevent the overflow condition.

Attack Vector

The attack is network-based and requires authenticated access with low privileges. An attacker who has obtained valid credentials (even with minimal permissions) can exploit this vulnerability by:

1. Establishing an authenticated session to the target Junos OS device
2. Initiating multiple telemetry sensor subscriptions at scale
3. Triggering the buffer overflow condition in the Packet Forwarding Engine
4. Causing all FPC connections to drop, resulting in a device crash and restart

The vulnerability manifests in the telemetry subscription handling mechanism within the Packet Forwarding Engine. When processing sensor subscriptions at scale without the appropriate YANG packages installed, insufficient buffer space is allocated on the stack. The overflow causes memory corruption that leads to an FPC crash. For detailed technical information, refer to the Juniper Security Advisory JSA106022.

Detection Methods for CVE-2026-21903

Indicators of Compromise

• Unexpected FPC crashes and restarts coinciding with telemetry subscription activity
• Syslog entries indicating stack overflow or memory corruption in the pfe process
• Abnormal telemetry subscription patterns from specific authenticated users or sessions
• Multiple simultaneous FPC connection drops across the device

Detection Strategies

• Monitor system logs for FPC crash events with signatures related to stack overflow or buffer corruption
• Implement alerting on abnormal telemetry subscription rates or patterns
• Configure SNMP traps for FPC state changes to detect exploitation attempts
• Review authentication logs for unusual access patterns to telemetry configuration interfaces

Monitoring Recommendations

• Enable detailed logging for the Packet Forwarding Engine component
• Configure real-time alerts for any FPC restart events
• Monitor authenticated session activity for users with telemetry configuration permissions
• Implement baseline monitoring for normal telemetry subscription behavior to detect anomalies

How to Mitigate CVE-2026-21903

Immediate Actions Required

• Upgrade to patched Junos OS versions: 22.4R3-S7, 23.2R2-S4, or 23.4R2 or later
• Install YANG packages for telemetry sensors to mitigate the vulnerability as an interim measure
• Review and restrict user accounts with permissions to configure telemetry subscriptions
• Implement network segmentation to limit authenticated access to management interfaces

Patch Information

Juniper Networks has released security patches addressing this vulnerability. Organizations should upgrade to the following versions or later:

For detailed patch information and download links, refer to the Juniper Support Portal.

Workarounds

• Install YANG packages for the specific telemetry sensors being used, as the vulnerability was not observed with these packages installed
• Limit or disable telemetry sensor subscriptions until patches can be applied
• Restrict network access to device management interfaces to trusted networks only
• Implement strict access controls for accounts with telemetry configuration privileges

# Example: Restrict management access to trusted networks
set system services netconf ssh
set firewall filter mgmt-access term allow-trusted from source-address 10.0.0.0/8
set firewall filter mgmt-access term allow-trusted then accept
set firewall filter mgmt-access term deny-all then reject