CVE-2026-33782
Memory Leak in Juniper jdhcpd Causes Denial-of-Service
Publication date: 2026-04-09
Last updated on: 2026-04-17
Assigner: Juniper Networks, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| juniper | junos | 22.4 |
| juniper | junos | 22.4 |
| juniper | junos | 22.4 |
| juniper | junos | 22.4 |
| juniper | junos | 23.2 |
| juniper | junos | 22.4 |
| juniper | junos | 23.2 |
| juniper | junos | 22.4 |
| juniper | junos | 22.4 |
| juniper | junos | 22.4 |
| juniper | junos | 23.2 |
| juniper | junos | 23.2 |
| juniper | junos | 23.4 |
| juniper | junos | 23.4 |
| juniper | junos | 23.4 |
| juniper | junos | 23.4 |
| juniper | junos | to 22.4 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-401 | The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
To mitigate the Missing Release of Memory vulnerability in the DHCP daemon (jdhcpd) of Juniper Networks Junos OS, you should monitor the memory usage of the jdhcpd process closely.
You can monitor memory usage with the command: show system processes extensive | match jdhcpd.
Additionally, upgrade Junos OS to a fixed version that addresses this issue. The affected versions are all versions before 22.4R3-S1, 23.2 versions before 23.2R2, and 23.4 versions before 23.4R2.
Can you explain this vulnerability to me?
This vulnerability is a Missing Release of Memory after Effective Lifetime issue in the DHCP daemon (jdhcpd) of Juniper Networks Junos OS on MX Series devices.
It occurs in DHCPv6 over PPPoE or DHCPv6 over VLAN scenarios with Active lease query or Bulk lease query, where every subscriber logout causes a small memory leak.
Over time, these leaks accumulate until all available memory is exhausted, causing the jdhcpd process to crash and restart.
This results in a complete Denial-of-Service (DoS) until the process recovers.
How can this vulnerability impact me? :
The vulnerability can lead to a complete Denial-of-Service (DoS) on affected Juniper MX Series devices running vulnerable versions of Junos OS.
As memory leaks accumulate with each subscriber logout, the DHCP daemon (jdhcpd) will eventually crash and restart, causing service interruptions.
This can disrupt network services relying on DHCP, potentially affecting connectivity and availability until the process recovers.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
The memory usage of the DHCP daemon (jdhcpd) can be monitored to detect this vulnerability.
- Use the command: show system processes extensive | match jdhcpd
Monitoring the memory usage of jdhcpd over time can help identify a memory leak caused by this vulnerability.