High priorityDisclosed

Advisory · CVE-2026-102050

Stack overflow in Junos l2cpd lets LLDP packets disrupt Layer 2 control processing

A stack-based buffer overflow in the l2cpd daemon of Junos OS and Junos OS Evolved lets an unauthenticated adjacent attacker deny service in Layer 2 control-plane processing via LLDP packets received on an interface configured for LLDP, with repeated triggering disrupting LLDP and other Layer 2 protocols device-wide. Juniper rates it CVSS 3.1 8.8.

Advisory published October 14, 2026Independent summary
Vendor
Juniper Networks
Product
Junos OS
Identifier / CWE
CVE-2026-102050
CWE-121
Action timing
Immediate
ELI5

Explain it like I’m five

Repeated discovery frames should be background noise; here they can take down the switch's Layer 2 brain.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01LLDP packets sent

    An adjacent unauthenticated attacker sends crafted LLDP packets to a configured interface.

  2. 02l2cpd stack overflows

    The daemon's stack buffer overflows while processing the packets.

  3. 03Layer 2 processing disrupted

    Repeated triggering disrupts LLDP and other Layer 2 control protocols on the device.

What happened

Juniper disclosed CVE-2026-102050 in its October 2026 security release: a stack-based buffer overflow (CWE-121) in the l2cpd daemon. LLDP packets received on an LLDP-configured interface can deny service in Layer 2 control-plane processing, and repeated triggering may disrupt other Layer 2 control protocols across the device.

Juniper’s JSA112187 lists the affected service releases and the October 2026 service release thresholds that carry the fix. Match your exact release to the advisory rather than guessing here.

What to do

  1. Inventory every Junos OS deployment, including test, training, and individually managed instances.
  2. Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
  3. Restrict network access to Junos OS while remediation is underway, especially for internet-facing instances.
  4. Review application and server logs for l2cpd restarts and LLDP neighbor loss following bursts of LLDP traffic.
  5. Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
  6. Verify the deployed version or patch level after remediation.

Management note

Pair this with CVE-2026-102049 in the same daemon and protocol. One LLDP review covers both.