Other information and services of the government: www.belgium.be Centre for Cybersecurity Belgium
search

Warning: Vulnerabilities in Juniper Junos OS allow Denial of Service (CVE-2026-33782, CVE-2026-33783). Patch Immediately!

Image
Decorative image
Published : 14/04/2026
  • Last update: 14/04/2026
  • Affected software:
    → Junos OS MX Series
    . Juniper Junos 22.4r3-s0; Juniper Junos 23.2r1; Juniper Junos 23.4r1
    → Junos OS Evolved on PTX Series
    . Junos Os Evolved 23.0; Junos Os Evolved 23.1; Junos Os Evolved 23.2; Junos Os Evolved 23.3; Junos Os Evolved 24.0; Junos Os Evolved 24.1; Junos Os Evolved 24.2; Junos Os Evolved 24.3; Junos Os Evolved 25.0; Junos Os Evolved 25.1
  • Type:
    → Missing Release of Memory after Effective Lifetime
    → Function Call with Incorrect Argument Type
  • CVE/CVSS
    → CVE-2026-33782: 8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/)
    → CVE-2026-33783: 7.1 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L)

Sources

NVD - https://nvd.nist.gov/vuln/detail/CVE-2026-33782
NVD - https://nvd.nist.gov/vuln/detail/CVE-2026-33783

Risks

Two vulnerabilities have been identified in Juniper Junos OS that could allow attackers to trigger a complete Denial of Service (DoS) condition on affected devices.

  • CVE-2026-33782: Unauthenticated adjacent attacker can exploit a memory leak.
  • CVE-2026-33783: Authenticated low-privileged attackers can trigger DoS.

Successful exploitation of either vulnerability can highly impact the availability of network devices and may disrupt critical services.

Description

CVE-2026-33782 (CVSS 8.7), is a Missing Release of Memory after Effective Lifetime vulnerability in the DHCP daemon (jdhcpd) of Juniper Networks Junos OS on MX Series, that allows an adjacent, unauthenticated attacker to cause a memory leak, that will eventually cause a complete DoS.

In a DHCPv6 over PPPoE, or DHCPv6 over VLAN with Active lease query or Bulk lease query scenario, every subscriber logout will leak a small amount of memory. When all available memory has been exhausted, jdhcpd will crash and restart which causes a complete service impact until the process has recovered.

CVE-2026-33783 (CVSS 7.1), a Function Call with Incorrect Argument Type vulnerability in the sensor interface of Juniper Networks Junos OS Evolved on PTX Series, allows a network-based, authenticated attacker with low privileges to cause a complete DoS.

If SRTE policy tunnels are provisioned via PCEP, and gRPC is used to monitor traffic in these tunnels, evo-aftmand crashes and doesn't restart which leads to a complete and persistent service impact. The system must be manually restarted to recover. The issue is seen only when the Originator ASN field in PCEP contains a value larger than 65,535 (32-bit ASN). The issue is not reproducible when SRTE policy tunnels are statically configured.

Recommended Actions

Patch
The Centre for Cybersecurity Belgium strongly recommends installing updates for vulnerable instances with the highest priority after thorough testing.

The following software releases have been updated to resolve these issues:

  • For CVE-2026-33782: 22.4R3-S1, 23.2R2, 23.4R2, 24.2R1, and all subsequent releases.
  • For CVE-2026-33783: 22.4R3-S9-EVO, 23.2R2-S6-EVO, 23.4R2-S7-EVO, 24.2R2-S4-EVO, 24.4R2-S2-EVO, 25.2R1-S2-EVO, 25.2R2-EVO, 25.4R1-EVO, and all subsequent releases.

Monitor/Detect
The CCB recommends organizations upscale monitoring and detection capabilities to identify any related suspicious activity and ensure a swift response in case of an intrusion

In case of an intrusion, you can report an incident via https://ccb.belgium.be/en/cert/report-incident.

While patching appliances or software to the newest version may protect against future exploitation, it does not remediate historic compromise.

References

NVD - https://nvd.nist.gov/vuln/detail/CVE-2026-33782
NVD - https://nvd.nist.gov/vuln/detail/CVE-2026-33783
Juniper - https://supportportal.juniper.net/s/article/2026-04-Security-Bulletin-Junos-OS-MX-Series-In-specific-DHCPv6-scenarios-jdhcpd-memory-increases-continuously-with-subscriber-logouts-CVE-2026-33782
Juniper - https://supportportal.juniper.net/s/article/2026-04-Security-Bulletin-Junos-OS-Evolved-PTX-Series-If-SRTE-tunnels-provisioned-via-PCEP-are-present-and-specific-gRPC-queries-are-received-evo-aftman-crashes-CVE-2026-33783