Vulnetix
Try Vulnetix Request Demo
CVE-2026-33782 PUBLISHED CVSS 8.699999809265137 HIGH

CVE-2026-33782 (CVSS 8.7), is a Missing Release of Memory after Effective Lifetime vulnerability in the DHCP daemon (jdhcpd) of Juniper Networks Junos OS on MX Series, that allows an adjacent, unauthenticated attacker to cause a memory leak, that will eventually cause a complete DoS. In a DHCPv6 over PPPoE, or DHCPv6 over VLAN with Active lease query or Bulk lease query scenario, every subscriber logout will leak a small amount of memory. When all available memory has been exhausted, jdhcpd will crash and restart which causes a complete service impact until the process has recovered. CVE-2026-33783 (CVSS 7.1), a Function Call with Incorrect Argument Type vulnerability in the sensor interface of Juniper Networks Junos OS Evolved on PTX Series, allows a network-based, authenticated attacker with low privileges to cause a complete DoS. If SRTE policy tunnels are provisioned via PCEP, and gRPC is used to monitor traffic in these tunnels, evo-aftmand crashes and doesn't restart which leads to a complete and persistent service impact. The system must be manually restarted to recover. The issue is seen only when the Originator ASN field in PCEP contains a value larger than 65,535 (32-bit ASN). The issue is not reproducible when SRTE policy tunnels are statically configured.

Risk Scores

CVSS v4.0
8.699999809265137
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/

Affected Products

VendorProductVersions
JunosJunos OS Evolved on PTX Series
JunosJunos OS MX Series

Timeline

References

Open in Interactive Console →