Junos OS: jdhcpd leaks memory on every subscriber logout until the DHCP daemon crashes

CVSS 8.7CVE-2026-33782Firmware, BMC & network fabriccurated

Impact

In DHCPv6-over-PPPoE, or DHCPv6-over-VLAN with active or bulk lease query, every subscriber logout leaks a small amount of memory in jdhcpd. An adjacent unauthenticated attacker who can repeatedly log in and out drives the daemon to memory exhaustion, at which point it crashes and restarts and DHCP service is fully down until it recovers. The scope is narrow: this only bites MX devices configured for subscriber management with those lease-query features, which is a broadband-edge configuration rather than anything a GPU cluster fabric normally runs - operators whose MX routers do plain transit are not exposed. Availability only. jdhcpd growth can be watched with 'show system processes extensive | match jdhcpd'.

Who can reach it

Adjacent network, unauthenticated: an attacker who can repeatedly establish and tear down DHCPv6 subscriber sessions on an affected MX, and only where the PPPoE/VLAN subscriber-management configuration above is in use.

What to do

Upgrade Junos OS to 22.4R3-S1, 23.2R2, or 23.4R2 or later per Juniper JSA107820. This is a device reload, so plan a maintenance window and shift subscribers to a redundant router first. Until then monitor jdhcpd memory and restart the daemon before it exhausts memory on its own.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-33782 https://kb.juniper.net/JSA107820

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.