{"id":"CVE-2026-102054","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-102054","generatedAt":"2026-10-28T04:18:39.051Z","title":"An Improper Handling of Length Parameter Inconsistency vulnerability in L2ALM of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to obtain stale PFE packet memory via VXLAN overlay-ping traffic sent to a local…","description":"An Improper Handling of Length Parameter Inconsistency vulnerability in L2ALM of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to obtain stale PFE packet memory via VXLAN overlay-ping traffic sent to a local VTEP.","published":"2026-10-14T17:18:00.000Z","lastModified":"2026-10-15T16:23:06.000Z","status":"Awaiting Analysis","sourceIdentifier":"sirt@juniper.net","cvss":{"version":"4.0","score":5.3,"severity":"MEDIUM","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-130"],"affected":[],"epss":{"score":0.00223,"percentile":0.12767,"date":"2026-10-27","history":[{"date":"2026-10-15","score":0.00222,"percentile":0.11894}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.22%). Track it; it rarely justifies an emergency change on its own."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-14T17:18:00.000Z","detail":{"score":"5.3","severity":"MEDIUM","publishedAt":"2026-10-14T17:18:00.433Z"},"summary":"New CVE, medium severity (CVSS 5.3)."}],"references":[{"url":"https://supportportal.juniper.net/JSA112187","source":"sirt@juniper.net"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-102054","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}