Cyber Resilience

CVE-2026-57019

Juniper Junos ≤ 23.2

Published
09 July 2026
Modified
13 July 2026
Patch / advisory
View advisory
CVSS Score v4 7.1
Click a component to see what it means
Raw vectorCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:X/RE:M/U:X
EPSS Score 0.0018 8th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-57019 is a high-severity Improper Validation of Specified Quantity in Input (CWE-1284) vulnerability in Juniper Junos. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SC-7 (Boundary Protection) and SI-2 (Flaw Remediation) — see the control section below for these in your framework.

EU & UK References

No EU or UK CSIRT advisories indexed for this CVE.

Vulnerability Data

An Improper Validation of Specified Quantity in Input vulnerability in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS on MX Series allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS). When a specific packet is received from…

more

device in the same broadcast domain, an affected system calculates the packet size incorrectly. This causes further packet processing to fail, which triggers an FPC major error, resulting in a FPC reset impacting traffic until the FPC has automatically recovered. Affected scenarios are: MAP-T, or non-IP traffic encapsulated in IP (e.g. MPLS over GRE). When this issue happens the following logs can be observed: fpc<#> CMError: /fpc/0/pfe/0/cm/0/MQSS(0)/0/MQSS_CMERROR_LI_INT_REG_UNROLL_TAIL_LENGTH_OVF (0x2205eb), scope: pfe, category: functional, severity: major, module: MQSS(0), type: LI: Unroll TAIL length overflow, oc_category: default fpc<#> Performing action reset-fru for error /fpc/0/pfe/0/cm/0/MQSS(0)/0/MQSS_CMERROR_LI_INT_REG_UNROLL_TAIL_LENGTH_OVF (0x2205eb) in module: MQSS(0) with scope: pfe category: functional level: major, oc_category: default This issue affects Junos OS on MX Series: * all versions before 23.2R2-S6, * 23.4 versions before 23.4R2-S7, * 24.2 versions before 24.2R2-S4, * 24.4 versions before 24.4R2-S4, * 25.2 versions before 25.2R2.

CWE(s)
CWE-1284

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
attack.mitre.org →
Why these techniques?

The vulnerability allows an unauthenticated adjacent attacker to trigger a packet-size miscalculation in the PFE that leads to an FPC reset (DoS). This directly maps to T1499.004 (Endpoint Denial of Service: Application or System Exploitation) because the flaw is exploited via crafted network traffic to exhaust or crash a critical forwarding component.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-33775Same product: Juniper Junos
CVE-2026-33782Same product: Juniper Junos
CVE-2026-57023Same product: Juniper Junos
CVE-2024-21587Same product: Juniper Junos
CVE-2026-33785Same product: Juniper Junos
CVE-2026-57054Same product: Juniper Junos
CVE-2025-52982Same product: Juniper Junos
CVE-2025-21594Same product: Juniper Junos
CVE-2024-47493Same product: Juniper Junos
CVE-2025-30660Same product: Juniper Junos

Affected Assets

juniper
junos
23.2, 23.4, 24.2, 24.4, 25.2 · ≤ 23.2

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SC-7 Boundary Protection
  • SI-2 Flaw Remediation
Detect
Catch it (NIST detect / respond)
  • SI-4 System Monitoring
Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V6.7.2
  • V1.4.2
  • V2.1.1
  • V2.2.1

Mitigating Controls (NIST 800-53 r5) AI

SC-7 Boundary Protection good match
prevent

Boundary protection at the network edge or adjacent segment can filter or drop the malformed MAP-T / MPLS-over-GRE packets before they reach the vulnerable Packet Forwarding Engine.

SI-4 System Monitoring good match
detect

Continuous monitoring of FPC/PFE logs and CMERROR events enables rapid detection of the MQSS unroll-tail-length overflow condition that precedes the FPC reset.

SI-2 Flaw Remediation good match
prevent

Timely application of the vendor-supplied Junos patches (23.2R2-S6, 23.4R2-S7, etc.) eliminates the improper packet-size validation flaw in the PFE.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require proper quantity/length validation in input handling.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
detects

Security testing in development can detect missing quantity validation but does not itself implement the control.

A.8.25 Secure development life cycle partial match
prevents

Secure development lifecycle mandates input validation for quantity fields, directly preventing CWE-1284.

A.8.26 Application security requirements partial match
prevents

Application security requirements explicitly call for validation of size/length inputs, mitigating CWE-1284.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure architecture principles encourage robust input handling but do not specifically address quantity validation.

A.8.28 Secure coding partial match
prevents

Secure coding standards require explicit checks on numeric quantity inputs, fully addressing CWE-1284.

References