{"schema":"threatline.record/2","record":{"id":"CVE-2026-101995","aliases":[],"summary":"Junos OS and Junos OS Evolved: Malformed ICCP packets cause l2ald memory disclosure and disruption","details":"An Improper Validation of Specified Quantity in Input vulnerability in the \n\nl2ald \n\nof Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker with access to an ICCP peer session to cause memory disclosure and disruption of the l2ald daemon via malformed ICCP packets.","categories":["Network & edge"],"product":"Junos OS","vendor":"Juniper Networks","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101995","source_modified_at":"2026-10-14T20:46:21.031Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"Junos OS","vendor":"Juniper Networks","versions":[{"lessThan":"23.2R2-S7.7","status":"affected","version":"0","versionType":"custom"},{"lessThan":"23.4R2-S8.13","status":"affected","version":"23.4","versionType":"custom"},{"lessThan":"24.2R2-S5.5","status":"affected","version":"24.2","versionType":"custom"},{"lessThan":"24.4R2-S5","status":"affected","version":"24.4","versionType":"custom"},{"lessThan":"25.2R2-S2","status":"affected","version":"25.2","versionType":"custom"},{"lessThan":"25.4R1-S3","status":"affected","version":"25.4","versionType":"custom"},{"lessThan":"26.2R1-S2","status":"affected","version":"26.2","versionType":"custom"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101995","source_modified_at":"2026-10-14T20:46:21.031Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"Junos OS Evolved","vendor":"Juniper Networks","versions":[{"lessThan":"23.2R2-S7.7-EVO","status":"affected","version":"0","versionType":"custom"},{"lessThan":"23.4R2-S8.11-EVO","status":"affected","version":"23.4","versionType":"custom"},{"lessThan":"24.2R2-S5.6-EVO","status":"affected","version":"24.2","versionType":"custom"},{"lessThan":"24.4R2-S5-EVO","status":"affected","version":"24.4","versionType":"custom"},{"lessThan":"25.2R2-S2-EVO","status":"affected","version":"25.2","versionType":"custom"},{"lessThan":"25.4R1-S3-EVO","status":"affected","version":"25.4","versionType":"custom"},{"lessThan":"26.2R1-S2-EVO","status":"affected","version":"26.2","versionType":"custom"},{"status":"affected","version":"23.4X100","versionType":"custom"},{"lessThan":"25.2X100-D35-EVO","status":"affected","version":"25.2X100","versionType":"custom"},{"lessThan":"25.4X300-D40-EVO","status":"affected","version":"25.4X300","versionType":"custom"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101995","source_modified_at":"2026-10-14T20:46:21.031Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"Junos OS","ecosystem":null},"version":"23.2R2-S7.7","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101995","source_modified_at":"2026-10-14T20:46:21.031Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"Junos OS","ecosystem":null},"version":"23.4R2-S8.13","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101995","source_modified_at":"2026-10-14T20:46:21.031Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"Junos OS","ecosystem":null},"version":"24.2R2-S5.5","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101995","source_modified_at":"2026-10-14T20:46:21.031Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"Junos OS","ecosystem":null},"version":"24.4R2-S5","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101995","source_modified_at":"2026-10-14T20:46:21.031Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"Junos OS","ecosystem":null},"version":"25.2R2-S2","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101995","source_modified_at":"2026-10-14T20:46:21.031Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"Junos OS","ecosystem":null},"version":"25.4R1-S3","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101995","source_modified_at":"2026-10-14T20:46:21.031Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"Junos OS","ecosystem":null},"version":"26.2R1-S2","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101995","source_modified_at":"2026-10-14T20:46:21.031Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"Junos OS Evolved","ecosystem":null},"version":"23.2R2-S7.7-EVO","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101995","source_modified_at":"2026-10-14T20:46:21.031Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"Junos OS Evolved","ecosystem":null},"version":"23.4R2-S8.11-EVO","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101995","source_modified_at":"2026-10-14T20:46:21.031Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"Junos OS Evolved","ecosystem":null},"version":"24.2R2-S5.6-EVO","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101995","source_modified_at":"2026-10-14T20:46:21.031Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"Junos OS Evolved","ecosystem":null},"version":"24.4R2-S5-EVO","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101995","source_modified_at":"2026-10-14T20:46:21.031Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"Junos OS Evolved","ecosystem":null},"version":"25.2R2-S2-EVO","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101995","source_modified_at":"2026-10-14T20:46:21.031Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"Junos OS Evolved","ecosystem":null},"version":"25.4R1-S3-EVO","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101995","source_modified_at":"2026-10-14T20:46:21.031Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"Junos OS Evolved","ecosystem":null},"version":"26.2R1-S2-EVO","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101995","source_modified_at":"2026-10-14T20:46:21.031Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"Junos OS Evolved","ecosystem":null},"version":"25.2X100-D35-EVO","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101995","source_modified_at":"2026-10-14T20:46:21.031Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"Junos OS Evolved","ecosystem":null},"version":"25.4X300-D40-EVO","basis":"first unaffected version stated in the CVE record"}],"cvss":4.3,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00223,"percentile":0.12269,"score_date":"2026-10-23"},"published_at":"2026-10-14T16:19:09.226Z","modified_at":"2026-10-14T20:46:21.031Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-101995","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-14T20:46:21.031Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101995","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://supportportal.juniper.net/JSA112187","tags":["vendor-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-14T20:37:07.970075Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"vendor and product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-14T20:46:21.031Z","content_hash":"46dae42a71a467c3b87b05c1d1152d72d5e4308869c7ddda11bda2f1d4fb78cf"}}