CVE-2026-33782
CVE-2026-33782 is a medium-severity vulnerability in Juniper Junos with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-401.
Key facts
- Severity: Medium (CVSS 3.x base score 6.5)
- CVSS v4: 8.7
- EPSS exploit prediction: 0% (21st percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2026-21091
- Weakness: CWE-401
- Affected product: Juniper Junos
- Published:
- Last modified:
Description
A Missing Release of Memory after Effective Lifetime vulnerability in the DHCP daemon (jdhcpd) of Juniper Networks Junos OS on MX Series, allows an adjacent, unauthenticated attacker to cause a memory leak, that will eventually cause a complete Denial-of-Service (DoS). In a DHCPv6 over PPPoE, or DHCPv6 over VLAN with Active lease query or Bulk lease query scenario, every subscriber logout will leak a small amount of memory. When all available memory has been exhausted, jdhcpd will crash and restart which causes a complete service impact until the process has recovered. The memory usage of jdhcpd can be monitored with: user@host> show system processes extensive | match jdhcpd This issue affects Junos OS: * all versions before 22.4R3-S1, * 23.2 versions before 23.2R2, * 23.4 versions before 23.4R2.
Frequently asked questions
- What is CVE-2026-33782?
- A Missing Release of Memory after Effective Lifetime vulnerability in the DHCP daemon (jdhcpd) of Juniper Networks Junos OS on MX Series, allows an adjacent, unauthenticated attacker to cause a memory leak, that will eventually cause a complete Denial-of-Service (DoS). In a DHCPv6 over PPPoE, or DHCPv6 over VLAN with Active lease query or Bulk lease query scenario, every subscriber logout will leak a small amount of memory. When all available memory has been exhausted, jdhcpd will crash and restart which causes a complete service impact until the process has recovered. The memory usage of jdhcpd can be monitored with: user@host> show system processes extensive | match jdhcpd This issue affects Junos OS: * all versions before 22.4R3-S1, * 23.2 versions before 23.2R2, * 23.4 versions before 23.4R2.
- How severe is CVE-2026-33782?
- CVE-2026-33782 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over an adjacent network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
- Is CVE-2026-33782 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (21st percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2026-33782?
- CVE-2026-33782 primarily affects Juniper Junos. In total, 17 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2026-33782?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- Does CVE-2026-33782 have an EU (EUVD) identifier?
- Yes. CVE-2026-33782 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-21091.
- When was CVE-2026-33782 published?
- CVE-2026-33782 was published on 2026-04-09 and last updated on 2026-06-17.
References
Affected products (17)
- cpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:22.4:-:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:22.4:r1:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:22.4:r1-s1:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:22.4:r1-s2:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:22.4:r2:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:22.4:r2-s1:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:22.4:r2-s2:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:22.4:r3:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:23.2:-:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:23.2:r1:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:23.2:r1-s1:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:23.2:r1-s2:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:23.4:-:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:23.4:r1:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:23.4:r1-s1:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:23.4:r1-s2:*:*:*:*:*:*
More vulnerabilities in Juniper Junos
- CVE-2021-0248 — Critical (CVSS 10.0): This issue is not applicable to NFX NextGen Software. On NFX Series devices the use of Hard-coded Credentials in…
- CVE-2021-0211 — Critical (CVSS 10.0): An improper check for unusual or exceptional conditions in Juniper Networks Junos OS and Junos OS Evolved Routing…
- CVE-2020-1614 — Critical (CVSS 10.0): A Use of Hard-coded Credentials vulnerability exists in the NFX250 Series for the vSRX Virtual Network Function (VNF)…
- CVE-2017-2343 — Critical (CVSS 10.0): The Integrated User Firewall (UserFW) feature was introduced in Junos OS version 12.1X47-D10 on the Juniper SRX Series…
- CVE-2013-4685 — Critical (CVSS 10.0): Buffer overflow in flowd in Juniper Junos 10.4 before 10.4S14, 11.4 before 11.4R7, 12.1 before 12.1R6, and 12.1X44…
- CVE-2017-2349 — Critical (CVSS 9.9): A command injection vulnerability in the IDP feature of Juniper Networks Junos OS on SRX series devices potentially…
All CVEs affecting Juniper Junos →
Other CWE-401 (Missing Release of Memory after Effective Lifetime) vulnerabilities
- CVE-2026-46289 — Critical (CVSS 9.8): In the Linux kernel, the following vulnerability has been resolved: lib/scatterlist: fix length calculations in…
- CVE-2022-0742 — Critical (CVSS 9.1): Memory leak in icmp6 implementation in Linux Kernel 5.13+ allows a remote attacker to DoS a host by making it go…
- CVE-2024-25450 — High (CVSS 8.8): imlib2 v1.9.1 was discovered to mishandle memory allocation in the function init_imlib_fonts().
- CVE-2023-33718 — High (CVSS 8.8): mp4v2 v2.1.3 was discovered to contain a memory leak via MP4File::ReadString() at mp4file_io.cpp
- CVE-2021-40633 — High (CVSS 8.8): A memory leak (out-of-memory) in gif2rgb in util/gif2rgb.c in giflib 5.1.4 allows remote attackers trigger an out of…
- CVE-2021-3492 — High (CVSS 8.8): Shiftfs, an out-of-tree stacking file system included in Ubuntu Linux kernels, did not properly handle faults occurring…
Browse all CWE-401 (Missing Release of Memory after Effective Lifetime) vulnerabilities →