CVE-2026-33775: A Missing Release of Memory after Effective Lifetime vulnerability in the BroadBand Edge subscriber management daemon…

CVE-2026-33775 · Severity: medium · CVSS 6.5 · Published 2026-04-09

A Missing Release of Memory after Effective Lifetime vulnerability in the BroadBand Edge subscriber management daemon (bbe-smgd) of Juniper Networks Junos OS on MX Series allows an adjacent, unauthenticated attacker to cause a Denial of Service (DoS).

If the authentication packet-type option is configured and a received packet does not match that packet type, the memory leak occurs. When all memory

available to bbe-smgd has been consumed, no new subscribers will be able to login.

The memory utilization of bbe-smgd can be monitored with the following show command:

user@host> show system processes extensive | match bbe-smgd

The below log message can be observed when this limit has been reached:

bbesmgd[<PID>]: %DAEMON-3-SMD_DPROF_RSMON_ERROR: Resource unavailability, Reason: Daemon Heap Memory exhaustion

This issue affects Junos OS on MX Series: * all versions before 22.4R3-S8, * 23.2 versions before 23.2R2-S5, * 23.4 versions before 23.4R2-S6, * 24.2 versions before 24.2R2-S2, * 24.4 versions before 24.4R2, * 25.2 versions before 25.2R2.

Technologies: Juniper Junos, Juniper Mx10004, Juniper Mx10008, Juniper Mx2008, Juniper Mx2010, Juniper Mx2020, Juniper Mx204, Juniper Mx240, Juniper Mx301, Juniper Mx304, Juniper Mx480, Juniper Mx960. Vendors: Juniper.

Quick answers

Is CVE-2026-33775 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-33775 being exploited in the wild.
How severe is CVE-2026-33775?
Medium severity, with a CVSS score of 6.5, published 9 April 2026.
Which products and versions are affected?
Juniper Junos, Juniper Mx10004, Juniper Mx10008, Juniper Mx2008 and 8 more. The advisory does not name versions.
Is there a fix for CVE-2026-33775?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
Am I affected by CVE-2026-33775?
Check whether you run Juniper Junos, Juniper Mx10004, Juniper Mx10008 or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Affected products

  • Juniper Junos
  • Juniper Mx10004
  • Juniper Mx10008
  • Juniper Mx2008
  • Juniper Mx2010
  • Juniper Mx2020
  • Juniper Mx204
  • Juniper Mx240
  • Juniper Mx301
  • Juniper Mx304
  • Juniper Mx480
  • Juniper Mx960

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.