Junos OS: MX Series: Mismatch between configured and received packet types causes memory leak in bbe-smgd

Summary

A Missing Release of Memory after Effective Lifetime vulnerability in the BroadBand Edge subscriber management daemon (bbe-smgd) of Juniper Networks Junos OS on MX Series allows an adjacent, unauthenticated attacker to cause a Denial of Service (DoS). If the authentication packet-type option is configured and a received packet does not match that packet type, the memory leak occurs. When all memory available to bbe-smgd has been consumed, no new subscribers will be able to login. The memory utilization of bbe-smgd can be monitored with the following show command: user@host> show system processes extensive | match bbe-smgd The below log message can be observed when this limit has been reached: bbesmgd[<PID>]: %DAEMON-3-SMD_DPROF_RSMON_ERROR: Resource unavailability, Reason: Daemon Heap Memory exhaustion This issue affects Junos OS on MX Series: • all versions before 22.4R3-S8, • 23.2 versions before 23.2R2-S5, • 23.4 versions before 23.4R2-S6, • 24.2 versions before 24.2R2-S2, • 24.4 versions before 24.4R2, • 25.2 versions before 25.2R2.

Timeline

1. Apr 9, 2026, 9:30 PM UTCCVE published
2. Apr 13, 2026, 5:40 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Apr 13, 2026, 6:06 PM UTCRecord last updated

Affected versions

• Juniper Networks Junos OS

  fixed in 22.4R3-S8; From 23.2 · fixed in 23.2R2-S5; From 23.4 · fixed in 23.4R2-S6; From 24.2 · fixed in 24.2R2-S2; From 24.4 · fixed in 24.4R2; From 25.2 · fixed in 25.2R2

References 1