Junos OS and Junos OS Evolved: Receipt of a specific SNMPv3 request results in memory leak and eventual snmpd crash

Summary

An Out-of-bounds Write vulnerability in the SNMP daemon (snmpd) of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated network-based attacker sending specific valid SNMPv3 queries to trigger a memory leak. Over time, continuous receipt of these queries will result in snmpd process memory exhaustion, resulting in a process crash and restart, impacting the ability to monitor the system via SNMP. Memory usage can be monitored using the following command: user@device> show system processes extensive | match snmpd This issue affects: Junos OS: • all versions before 21.2R3-S8; • from 21.4 before 21.4R3-S7; • from 22.1 before 22.1R3-S6; • from 22.2 before 22.2R3-S4; • from 22.3 before 22.3R3-S3; • from 22.4 before 22.4R3-S2; • from 23.2 before 23.2R2; • from 23.4 before 23.4R2. Junos OS Evolved: • all versions before 21.2R3-S8-EVO; • from 21.4 before 21.4R3-S7-EVO; • all versions of 22.1-EVO, • from 22.2 before 22.2R3-S4-EVO; • from 22.3 before 22.3R3-S3-EVO; • all versions of 22.4-EVO, • from 23.2 before 23.2R2-EVO; • from 23.4 before 23.4R2-EVO.

Timeline

1. Jul 9, 2026, 9:02 PM UTCCVE published
2. Jul 10, 2026, 1:31 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Jul 10, 2026, 1:31 PM UTCRecord last updated

Affected versions

• Juniper Networks Junos OS

  fixed in 21.2R3-S8; From 21.4 · fixed in 21.4R3-S7; From 22.1 · fixed in 22.1R3-S6; From 22.2 · fixed in 22.2R3-S4; From 22.3 · fixed in 22.3R3-S3; From 22.4 · fixed in 22.4R3-S2; From 23.2 · fixed in 23.2R2; From 23.4 · fixed in 23.4R2

• Juniper Networks Junos OS Evolved

  fixed in 21.2R3-S8-EVO; From 21.4 · fixed in 21.4R3-S7-EVO; From 22.1; From 22.2 · fixed in 22.2R3-S4-EVO; From 22.3 · fixed in 22.3R3-S3-EVO; From 22.4; From 23.2 · fixed in 23.2R2-EVO; From 23.4 · fixed in 23.4R2-EVO

References 1