CVE-2026-21911

CWE-6824 documents4 sources
Severity
7.1HIGH
EPSS
0.0%
top 99.50%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedJan 15

Description

An Incorrect Calculation vulnerability in the Layer 2 Control Protocol Daemon (l2cpd) of Juniper Networks Junos OS Evolved allows an unauthenticated network-adjacent attacker flapping the management interface to cause the learning of new MACs over label-switched interfaces (LSI) to stop while generating a flood of logs, resulting in high CPU usage. When the issue is seen, the following log message will be generated: op:1 flag:0x6 mac:xx:xx:xx:xx:xx:xx bd:2 ifl:13302 reason:0(REASON_NONE) i-o

CVSS vector

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L

Affected Packages2 packages

CVEListV5juniper_networks/junos_os_evolved22.222.2R3-S4-EVO+5

🔴Vulnerability Details

2
CVEList
Junos OS Evolved: Flapping management interface causes MAC learning on label-switched interfaces to stop2026-01-15
GHSA
GHSA-6fvr-r66p-5w4v: An Incorrect Calculation vulnerability in the Layer 2 Control Protocol Daemon (l2cpd) of Juniper Networks Junos OS Evolved allows an unauthenticated2026-01-15

📋Vendor Advisories

1
Juniper
CVE-2026-21911: An Incorrect Calculation vulnerability in the Layer 2 Control Protocol Daemon (l2cpd) of Juniper Networks Junos OS Evolved allows an unauthenticat2026-01-15
CVE-2026-21911 (HIGH CVSS 7.1) | An Incorrect Calculation vulnerabil | cvebase.io