Loading story…
Juniper Networks disclosed CVE-2026-33782, a high-severity flaw in the jdhcpd DHCP daemon on Junos OS MX Series devices that can trigger a memory leak and lead to denial of service. The issue affects deployments using DHCPv6 over PPPoE or DHCPv6 over VLAN when Active lease query or Bulk lease query is enabled, causing memory consumption to increase with each subscriber logout until jdhcpd crashes and restarts.
The resulting process failure can cause complete service impact until recovery. Juniper said affected versions include all releases before 22.4R3-S1, 23.2 releases before 23.2R2, and 23.4 releases before 23.4R2. Administrators can monitor for abnormal growth in daemon memory usage with:
show system processes extensive | match jdhcpd
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Belgium's Centre for Cybersecurity Belgium published an advisory warning that Juniper Junos OS contains denial-of-service vulnerabilities CVE-2026-33782 and CVE-2026-33783, and urged organizations to patch immediately. This adds public notice of a second related CVE not reflected in the existing timeline.
Juniper published a security bulletin for CVE-2026-33782 identifying affected releases and the versions containing fixes. The advisory states that releases before 22.4R3-S1, 23.2R2, and 23.4R2 are affected, indicating those versions as remediation points.
Juniper Networks disclosed a vulnerability in the jdhcpd DHCP daemon on Junos OS MX Series devices that can cause a memory leak and eventual denial of service in specific DHCPv6 environments. The issue affects DHCPv6 over PPPoE or VLAN deployments using Active lease query or Bulk lease query, where repeated subscriber logouts steadily increase memory usage until jdhcpd crashes and restarts.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
ccb.belgium.be
Open sourcesupportportal.juniper.net
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Juniper Networks disclosed two **Junos OS** vulnerabilities affecting multiple product lines that can trigger sustained memory growth and service disruption under specific network conditions. On **MX Series** devices, **`CVE-2026-33782`** causes the `jdhcpd` process to continuously increase memory usage in certain **DHCPv6** scenarios involving subscriber logouts, creating a risk of resource exhaustion on affected systems. A separate flaw, **`CVE-2026-33781`**, impacts **EX Series** and **QFX Series** switches in **VXLAN** deployments, where receipt of specific control-protocol packets can cause a memory leak that eventually results in a state where **no traffic is passed**. The advisories indicate that both issues are denial-of-service style conditions tied to memory exhaustion, with the affected behavior depending on particular protocol and deployment scenarios in Juniper environments.
Apr 9, 2026
Juniper Networks disclosed multiple high-severity vulnerabilities in **Junos OS** and **SRX/MX** platforms, including remotely exploitable denial-of-service flaws and local privilege-escalation issues. The most exposed bugs include **`CVE-2026-33790`**, which lets an unauthenticated attacker crash the `srxpfe` packet forwarding engine on **SRX Series** firewalls by sending a malformed **ICMPv6** packet to devices with **NAT64** enabled, and **`CVE-2026-33778`**, which allows a malformed initial **ISAKMP** packet to crash the `kmd` or `iked` daemons on **SRX** and **MX** systems providing IPsec VPN services. Juniper said repeated exploitation can sustain outages by forcing affected processes into crash loops, and that fixes were released through security bulletins including **`JSA107874`** and **`JSA107868`**. Juniper also fixed **`CVE-2026-33785`**, a missing authorization flaw in **MX Series** routers that allows any locally authenticated user to run privileged `request csds` commands and potentially compromise managed infrastructure in **JDM/CSDS** deployments, and **`CVE-2026-21916`**, a symlink-handling bug in the Junos CLI that can let a low-privileged user gain **root** when another user performs a configuration commit. Affected versions span several supported Junos release trains, with fixes issued on April 8, 2026; some older branches, including certain end-of-life releases, do not have patches. Detection guidance from Juniper and Tenable relies largely on version auditing, configuration review for exposed features such as NAT64 and IPsec, and monitoring for daemon crashes, suspicious `file link` activity, unexpected root access, and abuse of privileged management commands.
Jun 29, 2026
Juniper disclosed two denial-of-service vulnerabilities in **Junos OS Evolved** affecting **PTX Series** routers, with one issue also impacting the **QFX5000 Series**. The first flaw, tracked as **`CVE-2025-59969`**, allows an attacker to send crafted multicast packets that cause the `evo-aftmand` and `evo-pfemand` processes to crash and restart, disrupting forwarding-related functions on affected devices. A second vulnerability, **`CVE-2026-33783`**, affects PTX systems where **SR-TE tunnels provisioned via PCEP** are present; under those conditions, specific **gRPC** queries can trigger a crash in the `evo-aftman` process. Together, the advisories describe service instability risks in carrier-grade routing platforms, with crashes tied to malformed network traffic and management-plane queries rather than code execution.
Apr 9, 2026