Vulnerability Description
A Missing Release of Memory after Effective Lifetime vulnerability in the DHCP daemon (jdhcpd) of Juniper Networks Junos OS on MX Series, allows an adjacent, unauthenticated attacker to cause a memory leak, that will eventually cause a complete Denial-of-Service (DoS). In a DHCPv6 over PPPoE, or DHCPv6 over VLAN with Active lease query or Bulk lease query scenario, every subscriber logout will leak a small amount of memory. When all available memory has been exhausted, jdhcpd will crash and restart which causes a complete service impact until the process has recovered. The memory usage of jdhcpd can be monitored with: user@host> show system processes extensive | match jdhcpd This issue affects Junos OS: * all versions before 22.4R3-S1, * 23.2 versions before 23.2R2, * 23.4 versions before 23.4R2.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Juniper | Junos | < 22.4 |
| Juniper | Mx10004 | - |
| Juniper | Mx10008 | - |
| Juniper | Mx2008 | - |
| Juniper | Mx2010 | - |
| Juniper | Mx2020 | - |
| Juniper | Mx204 | - |
| Juniper | Mx240 | - |
| Juniper | Mx301 | - |
| Juniper | Mx304 | - |
| Juniper | Mx480 | - |
| Juniper | Mx960 | - |
Related Weaknesses (CWE)
References
- https://kb.juniper.net/JSA107820Vendor Advisory
FAQ
What is CVE-2026-33782?
CVE-2026-33782 is a vulnerability with a CVSS score of 6.5 (MEDIUM). A Missing Release of Memory after Effective Lifetime vulnerability in the DHCP daemon (jdhcpd) of Juniper Networks Junos OS on MX Series, allows an adjacent, unauthenticated attacker to cause a memory...
How severe is CVE-2026-33782?
CVE-2026-33782 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-33782?
Check the references section above for vendor advisories and patch information. Affected products include: Juniper Junos, Juniper Mx10004, Juniper Mx10008, Juniper Mx2008, Juniper Mx2010.