CVE-2026-101994

HighCVSS 7.1/10Last modified Oct 16, 2026

Description

An Improper Handling of Length Parameter Inconsistency vulnerability in the

l2ald

daemon of Juniper Networks Junos OS and Junos OS Evolved allows an attacker who can control or impersonate a configured MC-LAG ICCP peer to disclose process heap memory or cause a denial of service via a malformed ICCP message.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Weakness enumeration

CWE-130

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 14, 2026
Last modified
Oct 16, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1019954.3An Improper Validation of Specified Quantity in Input vulnerability in the l2ald of Juniper Networks Junos OS and Junos OS Evolved allowCVE-2026-1019966.5A Reachable Assertion vulnerability in the l2ald daemon of Juniper Networks Junos OS and Junos OS Evolved devices configured for MC-LAG/CVE-2026-1019978.1An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ipfd of Juniper Networks Junos OS oCVE-2026-1019985.9Docker Sandboxes could fail open while masking credentials in protected proxy responses. When a response-body read returned data together wiCVE-2026-1019996.5A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos EVO allows an adjacent attacker to cause a denCVE-2026-102005.3A vulnerability was found in Assimp up to 6.0.4. This affects the function glTFCommon::CopyValue in the library glTFCommon.h of the componenCVE-2026-1020006.5A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos EVO allows an adjacent unauthenticated attackeCVE-2026-1020023.1The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Sensitive Information ExpCVE-2026-1020047.8Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in memory corruption within the memory management subsystem. CVE-2026-1020055.5Wind River VxWorks 7 24.03 through 26.03, a memory leak occurs under specific, non-default configuration states when processing specific serCVE-2026-1020065.5In Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in the process management subsystem failing to properly reCVE-2026-1020077.2The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Stored Cro
CVE-2026-101994: High severity, CVSS 7.1 | Vulnix