CVE-2026-33782: A Missing Release of Memory after Effective Lifetime vulnerability in the DHCP daemon (jdhcpd) of Juniper Networks…

CVE-2026-33782 · Severity: medium · CVSS 6.5 · Published 2026-04-09

A Missing Release of Memory after Effective Lifetime vulnerability in the DHCP daemon (jdhcpd) of Juniper Networks Junos OS on MX Series, allows an adjacent, unauthenticated attacker to cause a memory leak, that will eventually cause a complete Denial-of-Service (DoS).

In a DHCPv6 over PPPoE, or DHCPv6 over VLAN with Active lease query or Bulk lease query scenario, every subscriber logout will leak a small amount of memory. When all available memory has been exhausted, jdhcpd will crash and restart which causes a complete service impact until the process has recovered.

The memory usage of jdhcpd can be monitored with:

user@host> show system processes extensive | match jdhcpd

This issue affects Junos OS:

* all versions before 22.4R3-S1, * 23.2 versions before 23.2R2, * 23.4 versions before 23.4R2.

Technologies: Juniper Junos, Juniper Mx10004, Juniper Mx10008, Juniper Mx2008, Juniper Mx2010, Juniper Mx2020, Juniper Mx204, Juniper Mx240, Juniper Mx301, Juniper Mx304, Juniper Mx480, Juniper Mx960. Vendors: Juniper.

Quick answers

Is CVE-2026-33782 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-33782 being exploited in the wild.
How severe is CVE-2026-33782?
Medium severity, with a CVSS score of 6.5, published 9 April 2026.
Which products and versions are affected?
Juniper Junos, Juniper Mx10004, Juniper Mx10008, Juniper Mx2008 and 8 more. The advisory does not name versions.
Is there a fix for CVE-2026-33782?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
Am I affected by CVE-2026-33782?
Check whether you run Juniper Junos, Juniper Mx10004, Juniper Mx10008 or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Affected products

  • Juniper Junos
  • Juniper Mx10004
  • Juniper Mx10008
  • Juniper Mx2008
  • Juniper Mx2010
  • Juniper Mx2020
  • Juniper Mx204
  • Juniper Mx240
  • Juniper Mx301
  • Juniper Mx304
  • Juniper Mx480
  • Juniper Mx960

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.