EUVD-2026-42700
GHSA-x7c3-q65h-rwrm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:Green
Network-reachable, low-complexity attack requiring SNMPv3 credentials (PR:L); impact limited to snmpd availability (A:L), no confidentiality or integrity effect.
Primary rating from Vendor (juniper).
CVSS VectorVendor: juniper
Lifecycle Timeline
2DescriptionCVE.org
An Out-of-bounds Write vulnerability in the SNMP daemon (snmpd) of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated network-based attacker sending specific valid SNMPv3 queries to trigger a memory leak. Over time, continuous receipt of these queries will result in snmpd process memory exhaustion, resulting in a process crash and restart, impacting the ability to monitor the system via SNMP.
Memory usage can be monitored using the following command:
user@device> show system processes extensive | match snmpd
This issue affects:
Junos OS:
- all versions before 21.2R3-S8;
- from 21.4 before 21.4R3-S7;
- from 22.1 before 22.1R3-S6;
- from 22.2 before 22.2R3-S4;
- from 22.3 before 22.3R3-S3;
- from 22.4 before 22.4R3-S2;
- from 23.2 before 23.2R2;
- from 23.4 before 23.4R2.
Junos OS Evolved:
- all versions before 21.2R3-S8-EVO;
- from 21.4 before 21.4R3-S7-EVO;
- all versions of 22.1-EVO,
- from 22.2 before 22.2R3-S4-EVO;
- from 22.3 before 22.3R3-S3-EVO;
- all versions of 22.4-EVO,
- from 23.2 before 23.2R2-EVO;
- from 23.4 before 23.4R2-EVO.
AnalysisAI
Memory exhaustion in Juniper Networks Junos OS and Junos OS Evolved snmpd allows an authenticated network attacker to crash SNMP monitoring by sending specific valid SNMPv3 queries that trigger an out-of-bounds write and progressive memory leak. The snmpd process will exhaust available memory over time, crash, and restart, rendering SNMP-based network monitoring unavailable for the duration of each crash cycle. No public exploit code has been identified at time of analysis, and this is not listed in CISA KEV; however, the CVSS 4.0 supplemental metric AU:Y indicates the attack is automatable.
Technical ContextAI
The affected component is snmpd, the SNMP daemon running on Juniper's Junos OS and Junos OS Evolved networking operating systems. The vulnerability is classified as CWE-787 (Out-of-bounds Write), meaning the daemon writes data beyond an allocated memory buffer when processing specific SNMPv3 query payloads. SNMPv3 introduces authentication and privacy features absent in earlier SNMP versions, and the flaw appears to reside in the parsing or state-management logic for these authenticated sessions. The memory region written out-of-bounds is not immediately fatal but causes a progressive memory leak - each malformed-but-valid query leaks a small amount of memory that is never reclaimed, ultimately exhausting the snmpd process heap. Juniper provides a diagnostic command ('show system processes extensive | match snmpd') for operators to monitor snmpd memory growth. Affected CPEs span both Junos OS (traditional) and Junos OS Evolved (the newer Linux-kernel-based variant) across multiple release trains from 21.2 through 23.4.
RemediationAI
Upgrade Junos OS to 21.2R3-S8, 21.4R3-S7, 22.1R3-S6, 22.2R3-S4, 22.3R3-S3, 22.4R3-S2, 23.2R2, or 23.4R2 (or later within the respective train). For Junos OS Evolved, upgrade to 21.2R3-S8-EVO, 21.4R3-S7-EVO, 22.2R3-S4-EVO, 22.3R3-S3-EVO, 23.2R2-EVO, or 23.4R2-EVO; note that 22.1-EVO and 22.4-EVO have no fixed release within their trains and require migration to a supported train. Full advisory details are at https://supportportal.juniper.net/JSA110074. Where patching is not immediately possible, restrict SNMPv3 access using firewall filters or access control lists to limit which management-plane source addresses can reach the snmpd listener - this reduces exposure to trusted management hosts only, though it does not eliminate risk from compromised management hosts. Disabling SNMP entirely is a viable short-term compensating control on devices where SNMP monitoring is not operationally required, at the cost of losing SNMP-based telemetry. Operators should also monitor snmpd memory growth via 'show system processes extensive | match snmpd' as an early-warning indicator.
named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 does not properly handle DNAME records when parsing fe
named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 allows remote attackers to cause a denial of service (
A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series and SRX Series all
jsdm/ajax/port.php in J-Web in Juniper Junos before 10.4R13, 11.4 before 11.4R7, 12.1 before 12.1R5, 12.2 before 12.2R3,
Juniper Junos 11.4 before R11, 12.1 before R9, 12.1X44 before D30, 12.1X45 before D20, 12.1X46 before D15, 12.1X47 befor
NFX Series devices using Juniper Networks Junos OS are susceptible to a local command execution vulnerability thereby al
NFX Series devices using Juniper Networks Junos OS are susceptible to a local code execution vulnerability thereby allow
Insufficient validation of environment variables in the telnet client supplied in Junos OS can lead to stack-based buffe
An Out-of-Bounds Write vulnerability in the H.323 ALG of Juniper Networks Junos OS allows an unauthenticated, network-ba
On QFX10000 Series devices using Juniper Networks Junos OS when configured as transit IP/MPLS penultimate hop popping (P
A Missing Release of Memory after Effective Lifetime vulnerability in the kernel of Juniper Networks Junos OS allows an
An Uncontrolled Memory Allocation vulnerability leading to a Heap-based Buffer Overflow in the packet forwarding engine
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today