CVE-2026-33799: Juniper Junos SNMP Memory Leak DoS Vulnerability

Technical summary

CVE-2026-33799 is an out-of-bounds write vulnerability (CWE-787) in the SNMP daemon component of Juniper Junos platforms. The flaw resides in SNMPv3 query handling logic, where improperly validated input allows memory to be written outside intended bounds. Rather than causing immediate crash, the defect manifests as a memory leak within the snmpd process address space. Continuous exploitation accelerates memory depletion. The CVSS v3.1 score of 4.3 (MEDIUM, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) reflects the network attack vector, low complexity, required authentication, and limited availability impact scope. No confidentiality or integrity compromise occurs.

Business impact

Loss of SNMP-based monitoring and alerting during snmpd crashes creates operational blind spots. Organizations relying on SNMP for network telemetry, performance trending, or third-party management system integration will experience service interruptions. While the impact is availability-focused rather than security-critical, recurring crashes in production environments degrade operational efficiency and may trigger false escalations if monitoring itself becomes unreliable. Affected environments should prioritize patching to maintain monitoring continuity.

Affected systems

All versions of Juniper Junos OS released before July 2026 are affected across multiple release branches: versions prior to 21.2R3-S8; 21.4 branch versions before 21.4R3-S7; 22.1 branch versions before 22.1R3-S6; 22.2 branch versions before 22.2R3-S4; 22.3 branch versions before 22.3R3-S3; 22.4 branch versions before 22.4R3-S2; 23.2 branch versions before 23.2R2; and 23.4 branch versions before 23.4R2. Junos OS Evolved carries identical vulnerable versions with -EVO suffixes (note that entire 22.1-EVO and 22.4-EVO branches remain affected). Organizations operating MX, PTX, or other Juniper platforms running these OS versions are in scope.

Exploitability

Exploitation requires network access to the SNMP service and valid SNMPv3 credentials. The attacker must be able to send SNMPv3 queries to the target device on the standard SNMP port (UDP 161). The complexity is low—no special conditions, race conditions, or user interaction are needed beyond possessing valid authentication. Once credentials are obtained or leveraged, an attacker can repeatedly trigger the vulnerability to induce memory exhaustion. The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities catalog, but the straightforward exploitation mechanism and clear technical trigger make it a practical concern for environments where SNMP credentials may be compromised or insufficiently restricted.

Remediation

Juniper has released patched versions across all affected branches. Organizations should apply the minimum patch version appropriate to their current release track: 21.2R3-S8 or later, 21.4R3-S7 or later, 22.1R3-S6 or later, 22.2R3-S4 or later, 22.3R3-S3 or later, 22.4R3-S2 or later, 23.2R2 or later, or 23.4R2 or later (with corresponding -EVO versions for Junos OS Evolved deployments). Testing patches in a lab environment before production deployment is recommended, particularly for mission-critical routing infrastructure. Consider scheduling patches during maintenance windows to minimize operational disruption.

Patch guidance

Verify your current Junos OS version using 'show version' on the device CLI. Cross-reference the output against the affected version ranges provided in the vulnerability description to determine if your device is in scope. Once patched versions are confirmed available for your platform, plan the upgrade during a maintenance window. Juniper recommends backing up the device configuration before any OS upgrade. Test the patched version in a non-production environment if possible. After upgrade, verify snmpd is functioning correctly using 'show system processes extensive | match snmpd' to confirm memory usage is normal and the process has restarted cleanly. If your organization uses a centralized management platform (such as Juniper Contrail or Junos Space), coordinate the patch rollout to maintain visibility across your infrastructure.

Detection guidance

Monitor snmpd process memory consumption using 'show system processes extensive | match snmpd' on affected devices. Baseline normal memory usage for your environment and alert if snmpd memory grows unexpectedly or the process repeatedly restarts. Enable SNMP access logs if available in your deployment to identify patterns of SNMPv3 queries originating from unexpected sources. Organizations with network flow visibility should monitor for sustained UDP/161 traffic from internal SNMP clients to Juniper devices; unusual query volume may indicate exploitation attempts. Ensure SNMP version 1 and 2c are disabled in favor of SNMPv3 to reduce credential exposure. Restrict SNMP access via access control lists to only authorized management subnets or hosts.

Why prioritize this

Although the CVSS score is moderate (4.3), the combination of low exploitation complexity, wide affected version range, and the operational disruption caused by repeated snmpd crashes warrants priority patching. The vulnerability is not a zero-day and patches exist across all branches. Environments with high SNMP monitoring dependency—particularly network operations centers relying on SNMP for alerting and performance data—should prioritize this fix ahead of less operationally impactful issues of similar or higher CVSS scores. The requirement for authentication and the lack of current KEV listings lower urgency compared to unauthenticated remote code execution flaws, but widespread deployments of Junos and the straightforward exploitation method mean this should be scheduled in the near-term patch cycle.

Risk score, explained

The CVSS v3.1 score of 4.3 reflects limited scope but practical impact. The attack vector is network-based (AV:N) with no special conditions required (AC:L), but authentication is mandatory (PR:L), reducing the threat model to insiders or attackers with compromised SNMP credentials. The impact is confined to availability (A:L); no data confidentiality or integrity is at stake. The score appropriately captures a denial-of-service risk that is real but bounded by credential requirements and availability-only impact. Organizations with strong SNMP credential hygiene and limited SNMP exposure may rate this lower in their personal risk appetite; those with broad SNMP deployment or weak credential controls should rate it higher operationally despite the numerical score.

Frequently asked questions