CVE detail

CVE-2021-0221 — CVE-2021-0221

Published 2021-01-15 · Modified 2026-06-17 · Vendor juniper · Product junos · Source nvd
MEDIUM
severity
CVSS-derived band
6.5
CVSS v3
0–10 scale
0.0051
EPSS probability
exploitation probability, 30d
41.0%
EPSS percentile
percentile vs all CVEs
NOT LISTED
CISA KEV
known exploited catalog

Description

In an EVPN/VXLAN scenario, if an IRB interface with a virtual gateway address (VGA) is configured on a PE, a traffic loop may occur upon receipt of specific IP multicast traffic. The traffic loop will cause interface traffic to increase abnormally, ultimately leading to a Denial of Service (DoS) in packet processing. The following command could be used to monitor the interface traffic: user@junos> monitor interface traffic Interface Link Input packets (pps) Output packets (pps) et-0/0/1 Up 6492089274364 (70994959) 6492089235319 (70994956) et-0/0/25 Up 343458103 (1) 156844 (0) ae0 Up 9132519197257 (70994959) 9132519139454 (70994956) This issue affects Juniper Networks Junos OS on QFX Series: all versions prior to 17.3R3-S10; 17.4 versions prior to 17.4R2-S12, 17.4R3-S3; 18.1 versions prior

Remediation

vendor remediation guidance

The following software releases have been updated to resolve this specific issue: Junos OS 17.3R3-S10, 17.4R2-S12, 17.4R3-S3, 18.1R3-S11, 18.2R3-S6, 18.3R3-S4, 18.4R2-S5, 18.4R3-S5, 19.1R1-S6, 19.1R2-S2, 19.1R3-S3, 19.2R1-S5, 19.2R3-S1, 19.3R2-S5, 19.3R3, 19.4R2-S2, 19.4R3, 20.1R2, 20.2R1-S2, 20.2R2, 20.3R1, and all subsequent releases.

workarounds

There are no known workarounds for this issue.

ProductVulnerable rangeFixed versionAdvisory
Juniper Networks Junos OS>=unspecified<17.3R3-S1017.3R3-S10advisory ↗
Juniper Networks Junos OS>=17.4<17.4R2-S12, 17.4R3-S317.4R2-S12, 17.4R3-S3advisory ↗
Juniper Networks Junos OS>=18.1<18.1R3-S1118.1R3-S11advisory ↗
Juniper Networks Junos OS>=18.2<18.2R3-S618.2R3-S6advisory ↗
Juniper Networks Junos OS>=18.3<18.3R3-S418.3R3-S4advisory ↗
Juniper Networks Junos OS>=18.4<18.4R2-S5, 18.4R3-S518.4R2-S5, 18.4R3-S5advisory ↗
Juniper Networks Junos OS>=19.1<19.1R1-S6, 19.1R2-S2, 19.1R3-S319.1R1-S6, 19.1R2-S2, 19.1R3-S3advisory ↗
Juniper Networks Junos OS>=19.2<19.2R1-S5, 19.2R3-S119.2R1-S5, 19.2R3-S1advisory ↗
Juniper Networks Junos OS>=19.3<19.3R2-S5, 19.3R319.3R2-S5, 19.3R3advisory ↗
Juniper Networks Junos OS>=19.4<19.4R2-S2, 19.4R319.4R2-S2, 19.4R3advisory ↗
Juniper Networks Junos OS>=20.1<20.1R220.1R2advisory ↗
Juniper Networks Junos OS>=20.2<20.2R1-S2, 20.2R220.2R1-S2, 20.2R2advisory ↗

References

cvedb.io · NVD · CISA KEV · FIRST EPSS · vendor advisories (CVE Program List v5). Informational only, no warranty — verify every remediation against the vendor advisory before acting on it. This product uses data from the NVD API but is not endorsed or certified by the NVD, CISA, FIRST.org or any vendor named. CVE® is a registered trademark of The MITRE Corporation.