Juniper Junos OS up to 22.4R3-S0/23.2R1/23.4R1 on MX memory leak

Summaryinfo

A vulnerability was found in Juniper Junos OS up to 22.4R3-S0/23.2R1/23.4R1 on MX. It has been classified as problematic. This impacts an unknown function. Performing a manipulation results in memory leak. This vulnerability is cataloged as CVE-2026-33782. The attack must originate from the local network. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Juniper Junos OS up to 22.4R3-S0/23.2R1/23.4R1 on MX. It has been classified as critical. This affects an unknown code block. The manipulation with an unknown input leads to a memory leak vulnerability. CWE is classifying the issue as CWE-401. The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory. This is going to have an impact on availability. The summary by CVE is:

A Missing Release of Memory after Effective Lifetime vulnerability in the DHCP daemon (jdhcpd) of Juniper Networks Junos OS on MX Series, allows an adjacent, unauthenticated attacker to cause a memory leak, that will eventually cause a complete Denial-of-Service (DoS). In a DHCPv6 over PPPoE, or DHCPv6 over VLAN with Active lease query or Bulk lease query scenario, every subscriber logout will leak a small amount of memory. When all available memory has been exhausted, jdhcpd will crash and restart which causes a complete service impact until the process has recovered. The memory usage of jdhcpd can be monitored with: user@host> show system processes extensive | match jdhcpd This issue affects Junos OS: * all versions before 22.4R3-S1, * 23.2 versions before 23.2R2, * 23.4 versions before 23.4R2.

It is possible to read the advisory at kb.juniper.net. This vulnerability is uniquely identified as CVE-2026-33782 since 03/23/2026. The exploitability is told to be easy. Access to the local network is required for this attack. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 305586 (Juniper Junos OS Vulnerability (JSA107820)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 22.4R3-S1, 23.2R2 or 23.4R2 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (305586). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• Juniper

Name

• Junos OS

Version

• 22.4R3-S0
• 23.2R1
• 23.4R1

License

• commercial

Website

• Vendor: https://www.juniper.net/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion