GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-57029 (GCVE-0-2026-57029)

Vulnerability from cvelistv5 – Published: 2026-07-09 21:12 – Updated: 2026-07-10 14:45
VLAI
Title
Junos OS Evolved: QFX Series: When sFlow collector reachability changes evo-pfemand process can crash
Summary
A Missing Synchronization vulnerability in the flow collector handler of Juniper Networks Junos OS Evolved on QFX Series allows an adjacent, unauthenticated attacker to cause a Denial-of-Service (DoS). When the reachability of an sFlow collector changes, the corresponding next-hop entry is updated. If this update occurs simultaneously with the sFlow thread accessing the next-hop data (which is outside the attackers control), it causes the evo-pfemand process to crash, impacting all traffic forwarding until the automatic process restart has completed. This issue affects Junos OS Evolved on QFX Series: * all 23.2 versions,  * 23.4 versions before 23.4R2-S7-EVO, * 24.2 versions before 24.2R2-S5-EVO, * 24.4 versions before 24.4R2-S3-EVO, * 25.2 versions before 25.2R2-EVO.
Severity
5.3 (Medium)
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
6 (Medium)
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/RE:M
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-10 14:44 UTC
CWE
  • CWE-820 - Missing Synchronization
Assigner
References
Impacted products
Vendor Product Version CPE status
Juniper Networks Junos OS Evolved Affected: 0 , < 23.4R2-S7-EVO (custom)
Affected: 24.2 , < 24.2R2-S5-EVO (custom)
Affected: 24.4 , < 24.4R2-S3-EVO (custom)
Affected: 25.2 , < 25.2R2-EVO (custom)
guessed Create a notification for this product.
Date Public
2026-07-08 16:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-57029",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-10T14:44:51.065414Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-10T14:45:20.380Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "QFX Series"
          ],
          "product": "Junos OS Evolved",
          "vendor": "Juniper Networks",
          "versions": [
            {
              "lessThan": "23.4R2-S7-EVO",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "24.2R2-S5-EVO",
              "status": "affected",
              "version": "24.2",
              "versionType": "custom"
            },
            {
              "lessThan": "24.4R2-S3-EVO",
              "status": "affected",
              "version": "24.4",
              "versionType": "custom"
            },
            {
              "lessThan": "25.2R2-EVO",
              "status": "affected",
              "version": "25.2",
              "versionType": "custom"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "To be exposed to this issue at least one sflow collector needs to be configured via:\u003cbr\u003e\u003cbr\u003e\u003ctt\u003e[ protocols\u0026nbsp;sflow collector \u0026lt;address\u0026gt;\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e]\u003c/span\u003e\u003c/tt\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "To be exposed to this issue at least one sflow collector needs to be configured via:\n\n[ protocols\u00a0sflow collector \u003caddress\u003e\u00a0]"
        }
      ],
      "datePublic": "2026-07-08T16:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A\u0026nbsp;Missing Synchronization vulnerability in the flow collector handler of Juniper Networks Junos OS Evolved on QFX Series allows an adjacent, unauthenticated attacker to cause a Denial-of-Service (DoS).\u003cp\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u003cbr\u003e\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eWhen the reachability of an sFlow collector changes, the corresponding next-hop entry is updated.\u0026nbsp;If this update occurs simultaneously with the sFlow thread accessing the next-hop data (which is outside the attackers control), it causes the evo-pfemand process to crash, impacting all traffic forwarding until the automatic process restart has completed.\u003c/span\u003e\u003cbr\u003e\n\n\u003cbr\u003e\u003cbr\u003eThis issue affects Junos OS Evolved on QFX Series:\u003cbr\u003e\u003c/p\u003e\u003cul\u003e\u003cli\u003eall 23.2 versions,\u0026nbsp;\u003c/li\u003e\u003cli\u003e23.4 versions before 23.4R2-S7-EVO,\u003c/li\u003e\u003cli\u003e24.2 versions before 24.2R2-S5-EVO,\u003c/li\u003e\u003cli\u003e24.4 versions before 24.4R2-S3-EVO,\u003c/li\u003e\u003cli\u003e25.2 versions before 25.2R2-EVO.\u003c/li\u003e\u003c/ul\u003e\u003cbr\u003e\u003cp\u003e\u003c/p\u003e"
            }
          ],
          "value": "A\u00a0Missing Synchronization vulnerability in the flow collector handler of Juniper Networks Junos OS Evolved on QFX Series allows an adjacent, unauthenticated attacker to cause a Denial-of-Service (DoS).\n\n\nWhen the reachability of an sFlow collector changes, the corresponding next-hop entry is updated.\u00a0If this update occurs simultaneously with the sFlow thread accessing the next-hop data (which is outside the attackers control), it causes the evo-pfemand process to crash, impacting all traffic forwarding until the automatic process restart has completed.\n\n\n\n\nThis issue affects Junos OS Evolved on QFX Series:\n\n\n  *  all 23.2 versions,\u00a0\n  *  23.4 versions before 23.4R2-S7-EVO,\n  *  24.2 versions before 24.2R2-S5-EVO,\n  *  24.4 versions before 24.4R2-S3-EVO,\n  *  25.2 versions before 25.2R2-EVO."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."
            }
          ],
          "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "YES",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "ADJACENT",
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/RE:M",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "MODERATE"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-820",
              "description": "CWE-820 Missing Synchronization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-09T21:12:36.288Z",
        "orgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968",
        "shortName": "juniper"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://supportportal.juniper.net/JSA110089"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The following software releases have been updated to resolve this specific issue:\n\nJunos OS Evolved: 23.4R2-S7-EVO, 24.2R2-S5-EVO, 24.4R2-S3-EVO, 25.2R2-EVO, 25.4R1-EVO, and all subsequent releases."
            }
          ],
          "value": "The following software releases have been updated to resolve this specific issue:\n\nJunos OS Evolved: 23.4R2-S7-EVO, 24.2R2-S5-EVO, 24.4R2-S3-EVO, 25.2R2-EVO, 25.4R1-EVO, and all subsequent releases."
        }
      ],
      "source": {
        "advisory": "JSA110089",
        "defect": [
          "1909536"
        ],
        "discovery": "USER"
      },
      "title": "Junos OS Evolved: QFX Series: When sFlow collector reachability changes evo-pfemand process can crash",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "There are no known workarounds for this issue."
            }
          ],
          "value": "There are no known workarounds for this issue."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968",
    "assignerShortName": "juniper",
    "cveId": "CVE-2026-57029",
    "datePublished": "2026-07-09T21:12:36.288Z",
    "dateReserved": "2026-06-23T16:27:00.249Z",
    "dateUpdated": "2026-07-10T14:45:20.380Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-57029",
      "date": "2026-09-19",
      "epss": "0.0019",
      "percentile": "0.08944"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "platforms": [
                  "QFX Series"
                ],
                "product": "Junos OS Evolved",
                "vendor": "Juniper Networks",
                "versions": [
                  {
                    "lessThan": "23.4R2-S7-EVO",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "24.2R2-S5-EVO",
                    "status": "affected",
                    "version": "24.2",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "24.4R2-S3-EVO",
                    "status": "affected",
                    "version": "24.4",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "25.2R2-EVO",
                    "status": "affected",
                    "version": "25.2",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "sirt@juniper.net"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:juniper:junos_os_evolved:23.2:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D1EC14A0-074B-445D-BDF8-7B54E38712F7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos_os_evolved:23.4:-:*:*:*:*:*:*",
                    "matchCriteriaId": "9D7F0D73-85EE-4A07-B51B-6BF52ECBA75E",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos_os_evolved:23.4:r1:*:*:*:*:*:*",
                    "matchCriteriaId": "FE777A1F-9CD9-426E-AF1C-FBE01EB9A4A8",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos_os_evolved:23.4:r1-s1:*:*:*:*:*:*",
                    "matchCriteriaId": "7147BA60-30A5-4CED-9AAF-F6BEA0528B89",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos_os_evolved:23.4:r1-s2:*:*:*:*:*:*",
                    "matchCriteriaId": "6E5CE59B-14B2-4F4C-81B5-0430EC954956",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos_os_evolved:23.4:r2:*:*:*:*:*:*",
                    "matchCriteriaId": "FB82B22F-9005-4EF0-A1E3-4261757783D4",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos_os_evolved:23.4:r2-s1:*:*:*:*:*:*",
                    "matchCriteriaId": "0224D3F1-8B86-432C-8F5B-B4B7B69ADF31",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos_os_evolved:23.4:r2-s2:*:*:*:*:*:*",
                    "matchCriteriaId": "EB2FE5FE-0ADE-406E-A23D-FDCC104B2496",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos_os_evolved:23.4:r2-s3:*:*:*:*:*:*",
                    "matchCriteriaId": "2E58987A-D7B7-4FFF-9969-E8FD76AE2BE3",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos_os_evolved:23.4:r2-s4:*:*:*:*:*:*",
                    "matchCriteriaId": "E779C0D4-A8F7-4976-B3C8-B9802B96E715",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos_os_evolved:23.4:r2-s5:*:*:*:*:*:*",
                    "matchCriteriaId": "C7457415-D893-474B-ABA6-9841BB5CC6DB",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos_os_evolved:23.4:r2-s6:*:*:*:*:*:*",
                    "matchCriteriaId": "3EFB8038-F336-4038-9AEA-C24253FAD578",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos_os_evolved:24.2:-:*:*:*:*:*:*",
                    "matchCriteriaId": "0DD89AAD-C615-42AF-B8AF-E6067862F0F5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos_os_evolved:24.2:r1:*:*:*:*:*:*",
                    "matchCriteriaId": "28AFF11D-E418-4A76-B557-F60622602537",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos_os_evolved:24.2:r1-s2:*:*:*:*:*:*",
                    "matchCriteriaId": "0A86A69D-2B90-4B3B-A6EC-88358284787D",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos_os_evolved:24.2:r2:*:*:*:*:*:*",
                    "matchCriteriaId": "080BEA58-9667-4C2C-810D-DC1187DB67DA",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos_os_evolved:24.2:r2-s1:*:*:*:*:*:*",
                    "matchCriteriaId": "34072A94-CFEB-4FAA-8E68-E98D4F7602E4",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos_os_evolved:24.2:r2-s2:*:*:*:*:*:*",
                    "matchCriteriaId": "C79FF7EC-AD91-4F9F-B8AC-B1A9C9271816",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos_os_evolved:24.2:r2-s3:*:*:*:*:*:*",
                    "matchCriteriaId": "7C61DC50-CAB6-4197-90C8-A2B48EE8F761",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos_os_evolved:24.2:r2-s4:*:*:*:*:*:*",
                    "matchCriteriaId": "178FFC73-28CC-471E-A1E8-1AF8BC731DD6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos_os_evolved:24.4:-:*:*:*:*:*:*",
                    "matchCriteriaId": "B32ADA05-5F5D-45B6-BB7B-3FA6A6F229F5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos_os_evolved:24.4:r1:*:*:*:*:*:*",
                    "matchCriteriaId": "D6526E82-A6A6-4A65-9B01-B3FCB947F44E",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos_os_evolved:24.4:r1-s2:*:*:*:*:*:*",
                    "matchCriteriaId": "CF3B74FA-DF84-4E3E-BCF9-44EEF9E45910",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos_os_evolved:24.4:r1-s3:*:*:*:*:*:*",
                    "matchCriteriaId": "DC024CDE-DA63-4E87-BA97-5E8C06B0D8B7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos_os_evolved:24.4:r2:*:*:*:*:*:*",
                    "matchCriteriaId": "25DA0DD2-E974-448C-BD05-ED6FCA4725FB",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos_os_evolved:24.4:r2-s1:*:*:*:*:*:*",
                    "matchCriteriaId": "C5F6F47F-0C86-4554-8517-A6A0CD29B3B0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos_os_evolved:24.4:r2-s2:*:*:*:*:*:*",
                    "matchCriteriaId": "8EDB7A3C-D1F5-4D24-8B8C-F104EC8C7D42",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos_os_evolved:25.2:-:*:*:*:*:*:*",
                    "matchCriteriaId": "DAF96553-DB70-4DFA-8658-306A7477DD06",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos_os_evolved:25.2:r1:*:*:*:*:*:*",
                    "matchCriteriaId": "83C415EF-E87B-4259-A836-59B3A9C3914B",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos_os_evolved:25.2:r1-s1:*:*:*:*:*:*",
                    "matchCriteriaId": "AFD32E67-9D8D-437D-96BC-CA97A1F686BA",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos_os_evolved:25.2:r1-s2:*:*:*:*:*:*",
                    "matchCriteriaId": "0E5D9967-1B53-427B-9B23-77DC399F3D71",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:juniper:qfx10008:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "1453E42A-77B3-4922-8EC3-1A5668C39550",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:juniper:qfx10016:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "26408465-BD6A-4416-B98E-691A5F651080",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:juniper:qfx5110:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "79A8847B-4F98-4949-8639-5CD2B411D10F",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:juniper:qfx5120:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "09EBDE4B-764F-4DF1-844A-BB8A52CD53EF",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:juniper:qfx5130:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "AB58A6E9-FFCF-4331-AC3B-45C37BD1943E",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:juniper:qfx5140:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C3F14350-BB10-411D-B144-FC762CA2608C",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:juniper:qfx5200:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "EDC5478F-A047-4F6D-BB11-0077A74C0174",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:juniper:qfx5210:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D877320D-1997-4B66-B11B-864020C755E1",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:juniper:qfx5220:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D193BEBD-9436-468D-B89E-D5720603451D",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:juniper:qfx5230-64cd:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "9F3D09BE-C16F-4E77-B6FB-C0C58BBD7675",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:juniper:qfx5240:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "9ABF8F9D-45C1-4554-A213-435A68709FCB",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:juniper:qfx5241:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "685120A6-7005-4ECB-A37F-0F225BB92676",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:juniper:qfx5250:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "574756C3-F97D-4193-A074-3091F978A1DC",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:juniper:qfx5700:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C7D6C74F-E85F-4D62-BDAF-FE619B467C76",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "A\u00a0Missing Synchronization vulnerability in the flow collector handler of Juniper Networks Junos OS Evolved on QFX Series allows an adjacent, unauthenticated attacker to cause a Denial-of-Service (DoS).\n\n\nWhen the reachability of an sFlow collector changes, the corresponding next-hop entry is updated.\u00a0If this update occurs simultaneously with the sFlow thread accessing the next-hop data (which is outside the attackers control), it causes the evo-pfemand process to crash, impacting all traffic forwarding until the automatic process restart has completed.\n\n\n\n\nThis issue affects Junos OS Evolved on QFX Series:\n\n\n  *  all 23.2 versions,\u00a0\n  *  23.4 versions before 23.4R2-S7-EVO,\n  *  24.2 versions before 24.2R2-S5-EVO,\n  *  24.4 versions before 24.4R2-S3-EVO,\n  *  25.2 versions before 25.2R2-EVO."
          }
        ],
        "id": "CVE-2026-57029",
        "lastModified": "2026-07-13T20:23:46.113",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.6,
              "impactScore": 3.6,
              "source": "sirt@juniper.net",
              "type": "Secondary"
            }
          ],
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "YES",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "ADJACENT",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 6.0,
                "baseSeverity": "MEDIUM",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "LOW",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:M/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "MODERATE"
              },
              "source": "sirt@juniper.net",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-57029",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-10T14:44:51.065414Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-07-09T22:17:08.453",
        "references": [
          {
            "source": "sirt@juniper.net",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://supportportal.juniper.net/JSA110089"
          }
        ],
        "sourceIdentifier": "sirt@juniper.net",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-820"
              }
            ],
            "source": "sirt@juniper.net",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-57029",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-10T14:44:51.065414Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-10T14:45:16.218Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "platforms": [
                "QFX Series"
              ],
              "product": "Junos OS Evolved",
              "vendor": "Juniper Networks",
              "versions": [
                {
                  "lessThan": "23.4R2-S7-EVO",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                },
                {
                  "lessThan": "24.2R2-S5-EVO",
                  "status": "affected",
                  "version": "24.2",
                  "versionType": "custom"
                },
                {
                  "lessThan": "24.4R2-S3-EVO",
                  "status": "affected",
                  "version": "24.4",
                  "versionType": "custom"
                },
                {
                  "lessThan": "25.2R2-EVO",
                  "status": "affected",
                  "version": "25.2",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "configurations": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "To be exposed to this issue at least one sflow collector needs to be configured via:\u003cbr\u003e\u003cbr\u003e\u003ctt\u003e[ protocols\u0026nbsp;sflow collector \u0026lt;address\u0026gt;\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e]\u003c/span\u003e\u003c/tt\u003e\n\n\u003cbr\u003e"
                }
              ],
              "value": "To be exposed to this issue at least one sflow collector needs to be configured via:\n\n[ protocols\u00a0sflow collector \u003caddress\u003e\u00a0]"
            }
          ],
          "datePublic": "2026-07-08T16:00:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "A\u0026nbsp;Missing Synchronization vulnerability in the flow collector handler of Juniper Networks Junos OS Evolved on QFX Series allows an adjacent, unauthenticated attacker to cause a Denial-of-Service (DoS).\u003cp\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u003cbr\u003e\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eWhen the reachability of an sFlow collector changes, the corresponding next-hop entry is updated.\u0026nbsp;If this update occurs simultaneously with the sFlow thread accessing the next-hop data (which is outside the attackers control), it causes the evo-pfemand process to crash, impacting all traffic forwarding until the automatic process restart has completed.\u003c/span\u003e\u003cbr\u003e\n\n\u003cbr\u003e\u003cbr\u003eThis issue affects Junos OS Evolved on QFX Series:\u003cbr\u003e\u003c/p\u003e\u003cul\u003e\u003cli\u003eall 23.2 versions,\u0026nbsp;\u003c/li\u003e\u003cli\u003e23.4 versions before 23.4R2-S7-EVO,\u003c/li\u003e\u003cli\u003e24.2 versions before 24.2R2-S5-EVO,\u003c/li\u003e\u003cli\u003e24.4 versions before 24.4R2-S3-EVO,\u003c/li\u003e\u003cli\u003e25.2 versions before 25.2R2-EVO.\u003c/li\u003e\u003c/ul\u003e\u003cbr\u003e\u003cp\u003e\u003c/p\u003e"
                }
              ],
              "value": "A\u00a0Missing Synchronization vulnerability in the flow collector handler of Juniper Networks Junos OS Evolved on QFX Series allows an adjacent, unauthenticated attacker to cause a Denial-of-Service (DoS).\n\n\nWhen the reachability of an sFlow collector changes, the corresponding next-hop entry is updated.\u00a0If this update occurs simultaneously with the sFlow thread accessing the next-hop data (which is outside the attackers control), it causes the evo-pfemand process to crash, impacting all traffic forwarding until the automatic process restart has completed.\n\n\n\n\nThis issue affects Junos OS Evolved on QFX Series:\n\n\n  *  all 23.2 versions,\u00a0\n  *  23.4 versions before 23.4R2-S7-EVO,\n  *  24.2 versions before 24.2R2-S5-EVO,\n  *  24.4 versions before 24.4R2-S3-EVO,\n  *  25.2 versions before 25.2R2-EVO."
            }
          ],
          "exploits": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."
                }
              ],
              "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            },
            {
              "cvssV4_0": {
                "Automatable": "YES",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "ADJACENT",
                "baseScore": 6,
                "baseSeverity": "MEDIUM",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "LOW",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/RE:M",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "MODERATE"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-820",
                  "description": "CWE-820 Missing Synchronization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-09T21:12:36.288Z",
            "orgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968",
            "shortName": "juniper"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://supportportal.juniper.net/JSA110089"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "The following software releases have been updated to resolve this specific issue:\n\nJunos OS Evolved: 23.4R2-S7-EVO, 24.2R2-S5-EVO, 24.4R2-S3-EVO, 25.2R2-EVO, 25.4R1-EVO, and all subsequent releases."
                }
              ],
              "value": "The following software releases have been updated to resolve this specific issue:\n\nJunos OS Evolved: 23.4R2-S7-EVO, 24.2R2-S5-EVO, 24.4R2-S3-EVO, 25.2R2-EVO, 25.4R1-EVO, and all subsequent releases."
            }
          ],
          "source": {
            "advisory": "JSA110089",
            "defect": [
              "1909536"
            ],
            "discovery": "USER"
          },
          "title": "Junos OS Evolved: QFX Series: When sFlow collector reachability changes evo-pfemand process can crash",
          "workarounds": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "There are no known workarounds for this issue."
                }
              ],
              "value": "There are no known workarounds for this issue."
            }
          ],
          "x_generator": {
            "engine": "Vulnogram 0.1.0-dev"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968",
        "assignerShortName": "juniper",
        "cveId": "CVE-2026-57029",
        "datePublished": "2026-07-09T21:12:36.288Z",
        "dateReserved": "2026-06-23T16:27:00.249Z",
        "dateUpdated": "2026-07-10T14:45:20.380Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.