EUVD-2026-21091
GHSA-rpvg-7w65-9g7p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend DHCPv6 subscriber logout packets
-
DeliveryMemory leak in jdhcpd process
-
ExploitExhaust available system memory
-
Executionjdhcpd crashes and restarts
-
ImpactDHCP service becomes unavailable
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Resource cleanup, leak prevention
|
| Exploitation Conditions | Juniper Networks Junos OS on MX Series with DHCPv6 over PPPoE or DHCPv6 over VLAN configured with Active lease query or Bulk lease query enabled. Adjacent unauthenticated attacker triggers memory leak through repeated subscriber logouts, eventually causing jdhcpd crash and DoS. |
| Impact | High-severity network DoS affecting MX Series routers via unauthenticated adjacent DHCP. Memory leak in jdhcpd causes complete service crash after exhausting RAM through repeated DHCPv6 subscriber logouts. Network availability impact is severe; however, attack requires adjacent network access and specific DHCPv6 scenarios (PPPoE/VLAN with lease queries), limiting exposure scope versus internet-wide threats. |
| Exploit ScenarioDerived | Attacker on adjacent network repeatedly connects/disconnects DHCPv6 clients over PPPoE or VLAN with active/bulk lease query enabled. Each logout leaks memory; sustained attack exhausts jdhcpd heap, causing daemon crash and router service interruption until manual recovery. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 09, 2026
Memory leak in Juniper Networks Junos OS jdhcpd daemon enables adjacent unauthenticated attackers to crash DHCP services on MX Series routers. Each DHCPv6 subscriber logout in PPPoE or VLAN configurations with active/bulk lease query leaks memory, eventually exhausting resources and triggering jdhcpd crash. Service remains unavailable until process restart completes. Affects all Junos OS versions before 22.4R3-S1, 23.2 versions before 23.2R2, and 23.4 versions before 23.4R2. No public exploit identified at time of analysis.
RemediationAI
Vendor-released patches available: upgrade to Junos OS 22.4R3-S1, 23.2R2, or 23.4R2 depending on current deployment branch. Workarounds for unpatched systems include disabling DHCPv6 active lease query and bulk lease query features if operationally feasible, though this reduces DHCP functionality. Monitor jdhcpd memory consumption using 'show system processes extensive | match jdhcpd' to detect leak progression and schedule maintenance before exhaustion occurs. Official vendor advisory with complete mitigation details: https://kb.juniper.net/JSA107820
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-401 memory management flaw in jdhcpd process handling DHCPv6 lease query operations. Memory allocation during subscriber session teardown lacks proper deallocation, creating persistent leaks proportional to logout events. Cumulative exhaustion forces daemon termination rather than graceful degradation.
Know when Junos Os gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/RE:M
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
A Missing Release of Memory after Effective Lifetime vulnerability in the DHCP daemon (jdhcpd) of Juniper Networks Junos OS on MX Series, allows an adjacent, unauthenticated attacker to cause a memory leak, that will eventually cause a complete Denial-of-Service (DoS).
In a DHCPv6 over PPPoE, or DHCPv6 over VLAN with Active lease query or Bulk lease query scenario, every subscriber logout will leak a small amount of memory. When all available memory has been exhausted, jdhcpd will crash and restart which causes a complete service impact until the process has recovered.
The memory usage of jdhcpd can be monitored with:
user@host> show system processes extensive | match jdhcpd
This issue affects Junos OS:
- all versions before 22.4R3-S1,
- 23.2 versions before 23.2R2,
- 23.4 versions before 23.4R2.
Executive ViewAI
CVE-2026-33782 is a memory leak vulnerability in Juniper Junos OS affecting MX Series routers that allows adjacent network attackers to crash the DHCP service through repeated DHCPv6 subscriber logouts, resulting in service unavailability until manual process restart. Organizations running affected Junos OS versions with PPPoE or VLAN-based DHCP subscribers face potential network connectivity disruptions for enterprise users and customers dependent on DHCP services.
Apply vendor patch. If immediate patching is not feasible, implement network segmentation to restrict DHCP subscriber access to trusted networks only, monitor jdhcpd process restarts for early detection of exploit attempts, and establish automated process restart procedures to minimize service downtime during active exploitation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
OS command injection in the phcd phone-home daemon of Juniper Networks Junos OS and Junos OS Evolved lets an adjacent, u
Unauthenticated remote code execution with root privileges affects Juniper Networks Junos OS devices that expose the J-W
Heap-based buffer overflow in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allow
A stack-based buffer overflow in the srxpfe packet forwarding process of Juniper Networks Junos OS on SRX Series devices
Unauthenticated remote code execution with elevated privileges is possible in Juniper Junos OS and Junos OS Evolved thro
Remote root code execution in the routing protocol daemon (rpd) of Juniper Junos OS is reachable through protocol-valid
Remote code execution (on Junos OS) and rpd denial of service (on Junos OS and Junos OS Evolved) result from a stack-bas
Remote code execution with root privileges on Juniper Networks Junos OS and Junos OS Evolved is possible when the routin
Remote code execution and denial of service in Juniper Networks Junos OS and Junos OS Evolved arise from a stack-based b
Unauthenticated remote attackers can gain root-level configuration access and fully compromise Juniper Junos OS and Juno
Integer underflow in the Junos OS kernel can crash a device when the Extended Echo feature (RFC 8335 ICMP probing) is co
Heap-based buffer overflow in Juniper Networks Junos OS on SRX Series devices that have Secure Vector Routing (SVR) enab
Exploit-DB