CVE-2026-33799— Junos OS and Junos OS Evolved: Receipt of a specific SNMPv3 request results in memory leak and eventual snmpd crash
Quick assessment
Affected
Juniper Networks Junos OS
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Juniper Networks Junos OS是美国Juniper Networks公司的一款专为路由器、交换机和防火墙等物理及虚拟设备打造的网络操作系统。 Juniper Networks Junos OS和Junos OS Evolved存在缓冲区错误漏洞，该漏洞源于SNMP daemon (snmpd)中的Out-of-bounds Write漏洞，可能导致经过身份验证的网络攻击者通过发送特定有效的SNMPv3查询触发内存泄漏，长期连续接收这些查询将导致snmpd进程内存耗尽，造成进程崩溃并重启
Possible ATT&CK Techniques 3 AI
T1071 · Application Layer Protocol T1499.002 · Service Exhaustion Flood T1499 · Endpoint Denial of ServiceAffected Version Matrix 16
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Juniper Networks | Junos OS | < 21.2R3-S8 |
affected |
21.4< 21.4R3-S7 |
affected | ||
22.1< 22.1R3-S6 |
affected | ||
22.2< 22.2R3-S4 |
affected | ||
22.3< 22.3R3-S3 |
affected | ||
22.4< 22.4R3-S2 |
affected | ||
23.2< 23.2R2 |
affected | ||
23.4< 23.4R2 |
affected | ||
| Juniper Networks | Junos OS Evolved | < 21.2R3-S8-EVO |
affected |
21.4< 21.4R3-S7-EVO |
affected | ||
22.1< 22.1* |
affected | ||
22.2< 22.2R3-S4-EVO |
affected | ||
22.3< 22.3R3-S3-EVO |
affected | ||
22.4< 22.4* |
affected | ||
23.2< 23.2R2-EVO |
affected | ||
23.4< 23.4R2-EVO |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-33799
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Junos OS and Junos OS Evolved: Receipt of a specific SNMPv3 request results in memory leak and eventual snmpd crash
Source: CVE Program / CVE List V5
Vulnerability Description
An Out-of-bounds Write vulnerability in the SNMP daemon (snmpd) of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated network-based attacker sending specific valid SNMPv3 queries to trigger a memory leak. Over time, continuous receipt of these queries will result in snmpd process memory exhaustion, resulting in a process crash and restart, impacting the ability to monitor the system via SNMP.
Memory usage can be monitored using the following command:
user@device> show system processes extensive | match snmpd
This issue affects:
Junos OS:
* all versions before 21.2R3-S8;
* from 21.4 before 21.4R3-S7;
* from 22.1 before 22.1R3-S6;
* from 22.2 before 22.2R3-S4;
* from 22.3 before 22.3R3-S3;
* from 22.4 before 22.4R3-S2;
* from 23.2 before 23.2R2;
* from 23.4 before 23.4R2.
Junos OS Evolved:
* all versions before 21.2R3-S8-EVO;
* from 21.4 before 21.4R3-S7-EVO;
* all versions of 22.1-EVO,
* from 22.2 before 22.2R3-S4-EVO;
* from 22.3 before 22.3R3-S3-EVO;
* all versions of 22.4-EVO,
* from 23.2 before 23.2R2-EVO;
* from 23.4 before 23.4R2-EVO.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存写
Source: CVE Program / CVE List V5
Vulnerability Title
Juniper Networks Junos OS 缓冲区错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Juniper Networks Junos OS是美国Juniper Networks公司的一款专为路由器、交换机和防火墙等物理及虚拟设备打造的网络操作系统。 Juniper Networks Junos OS和Junos OS Evolved存在缓冲区错误漏洞，该漏洞源于SNMP daemon (snmpd)中的Out-of-bounds Write漏洞，可能导致经过身份验证的网络攻击者通过发送特定有效的SNMPv3查询触发内存泄漏，长期连续接收这些查询将导致snmpd进程内存耗尽，造成进程崩溃并重启
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Juniper Networks | Junos OS | 0 ~ 21.2R3-S8 | - |
|
| Juniper Networks | Junos OS Evolved | 0 ~ 21.2R3-S8-EVO | - |
|
II. Public POCs for CVE-2026-33799
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-33799
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-33799 (1)
Same Patch Batch · Juniper Networks · 2026-07-09 · 22 CVEs total
| CVE-2026-57026 | 7.5 HIGH | Junos OS: MX Series with SPC3, SRX Series: Processing of a specifically malformed SIP invi |
| CVE-2026-57023 | 7.5 HIGH | Junos OS: MX with SPC3, SRX Series: A specifically malformed TCP packet causes a flowd cra |
| CVE-2026-57028 | 7.3 HIGH | Junos OS Evolved: A port which has been inadvertently exposed can be reached by an attacke |
| CVE-2026-57032 | 6.5 MEDIUM | Junos OS: EX Series: Subscribing to an unsupported telemetry sensor path causes fxpc proce |
| CVE-2026-33800 | 6.5 MEDIUM | Junos OS: MX Series: In a VC scenario a high rate of micro-BFD session flaps will cause an |
| CVE-2026-33801 | 6.5 MEDIUM | Junos OS and Junos OS Evolved: When a specifically malformed BGP route update is received |
| CVE-2026-33803 | 6.5 MEDIUM | Junos OS Evolved: A port which has been inadvertently exposed can be reached by an attacke |
| CVE-2026-57019 | 6.5 MEDIUM | Junos OS: MX Series: Specific traffic causes an FPC to reset |
| CVE-2026-57020 | 6.5 MEDIUM | Junos OS: QFX10000 Series: IPv6 multicast traffic received on non-IRB interfaces causes a |
| CVE-2026-57027 | 6.5 MEDIUM | Junos OS: EX4100 Series, EX4400: With sFlow configured in a VC scenario multicast traffic |
| CVE-2026-57022 | 5.9 MEDIUM | Junos OS: MX Series with SPC3, SRX Series: Specific packet in response to a TCP connection |
| CVE-2026-57030 | 5.9 MEDIUM | Junos OS: SRX Series: Flow sessions are not getting cleared leading to a DoS |
| CVE-2026-33794 | 5.9 MEDIUM | Junos OS Evolved: PTX Series: Receipt of repeated ECMP routing updates results in PFE cras |
| CVE-2026-57054 | 5.8 MEDIUM | Junos OS: MX Series: Web filtering doesn't block specifically formatted URLs |
| CVE-2026-57025 | 5.5 MEDIUM | Junos OS and Junos OS Evolved: EX Series, QFX Series, MX Series: A specific 'show l2-learn |
| CVE-2026-33802 | 5.5 MEDIUM | Junos OS: EX Series: Unauthorized users can execute service-impacting CLI command |
| CVE-2026-57024 | 5.3 MEDIUM | Junos OS: MX with SPC3, SRX Series: Repeated VPN negotiation failures will eventually caus |
| CVE-2026-57021 | 5.3 MEDIUM | Junos OS: SRX Series: If VPN compliance-check is configured an attacker can cause http-gk |
| CVE-2026-57029 | 5.3 MEDIUM | Junos OS Evolved: QFX Series: When sFlow collector reachability changes evo-pfemand proces |
| CVE-2026-57031 | 4.7 MEDIUM | Junos OS: MX Series: For subscribers configured on static interfaces, input filters are no |
Showing top 20 of 22 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Junos OS
-
CVE-2026-101954
Junos OS and Junos OS Evolved: Unauthenticated network acces -
CVE-2026-101952
Junos OS and Junos OS Evolved: A specific BGP ISO-VPN update -
CVE-2026-101949
Junos OS and Junos OS Evolved: In a scenario with VPN-flowsp -
CVE-2026-101964
Junos OS and Junos OS Evolved: An attacker can cause an rpd -
CVE-2026-101963
Junos OS and Junos OS Evolved: A BGP EVPN neighbor causes an
Same vendor: Juniper Networks
-
CVE-2026-106079
Session Smart Router and Session Smart Conductor: Improper v -
CVE-2026-103411
Session Smart Router: A malicious DHCP server causes informa -
CVE-2026-103410
Session Smart Router: Integer overflow causes denial of serv -
CVE-2026-103409
Session Smart Router: An attacker obtains administrative pri -
CVE-2026-103408
Session Smart Router: An attacker-controlled input causes re
Same weakness: CWE-787
-
CVE-2026-119777
Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: st -
CVE-2026-104067
Scribus before 1.6.7 Out-of-Bounds Memory Access via SVM Imp -
CVE-2026-104066
Scribus before 1.6.7 Heap Buffer Overflow via PICT 4-bit Pix -
CVE-2026-104065
Scribus before 1.6.7 Heap Out-of-Bounds Write via Micrografx -
CVE-2026-104062
Scribus before 1.6.7 Heap Buffer Overflow via PICT Pixmap Lo