Junos OS (SRX firewalls)
CVE-2024-21587: MX Series: Memory leak in bbe-smgd process if BFD liveness detection for DHCP subscribers is enabled
An Improper Handling of Exceptional Conditions vulnerability in the broadband edge subscriber management daemon (bbe-smgd) of Juniper Networks Junos OS on MX Series allows an attacker directly connected to the vulnerable system who repeatedly flaps DHCP subscriber sessions to cause a slow memory leak, ultimately leading to a Denial of Service (DoS).
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Junos OS (MX Series) 0 | 20.4R3-S9 or later |
| Junos OS (MX Series) 21.2 | 21.2R3-S7 or later |
| Junos OS (MX Series) 21.3 | 21.3R3-S5 or later |
| Junos OS (MX Series) 21.4 | 21.4R3-S5 or later |
| Junos OS (MX Series) 22.1 | 22.1R3-S4 or later |
| Junos OS (MX Series) 22.2 | 22.2R3-S3 or later |
| Junos OS (MX Series) 22.3 | 22.3R3-S2 or later |
| Junos OS (MX Series) 22.4 | 22.4R2-S2, 22.4R3 or later |
| Junos OS (MX Series) 23.2 | 23.2R1-S1, 23.2R2 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
An Improper Handling of Exceptional Conditions vulnerability in the broadband edge subscriber management daemon (bbe-smgd) of Juniper Networks Junos OS on MX Series allows an attacker directly connected to the vulnerable system who repeatedly flaps DHCP subscriber sessions to cause a slow memory leak, ultimately leading to a Denial of Service (DoS). Memory can only be recovered by manually restarting bbe-smgd.
This issue only occurs if BFD liveness detection for DHCP subscribers is enabled. Systems without BFD liveness detection enabled are not vulnerable to this issue.
Indication of the issue can be observed by periodically executing the 'show system processes extensive' command, which will indicate an increase in memory allocation for bbe-smgd. A small amount of memory is leaked every time a DHCP subscriber logs in, which will become visible over time, ultimately leading to memory starvation.
user@junos> show system processes extensive | match bbe-smgd 13071 root 24 0 415M 201M select 0 0:41 7.28% bbe-smgd{bbe-smgd} 13071 root 20 0 415M 201M select 1 0:04 0.00% bbe-smgd{bbe-smgd} ... user@junos> show system processes extensive | match bbe-smgd 13071 root 20 0 420M 208M select 0 4:33 0.10% bbe-smgd{bbe-smgd} 13071 root 20 0 420M 208M select 0 0:12 0.00% bbe-smgd{bbe-smgd} ... This issue affects Juniper Networks Junos OS on MX Series:
- All versions earlier than 20.4R3-S9;
- 21.2 versions earlier than 21.2R3-S7;
- 21.3 versions earlier than 21.3R3-S5;
- 21.4 versions earlier than 21.4R3-S5;
- 22.1 versions earlier than 22.1R3-S4;
- 22.2 versions earlier than 22.2R3-S3;
- 22.3 versions earlier than 22.3R3-S2;
- 22.4 versions earlier than 22.4R2-S2, 22.4R3;
- 23.2 versions earlier than 23.2R1-S1, 23.2R2.
Am I affected?
DHCP liveness detection is enabled and configured as follows:
[edit forwarding-options dhcp-relay] user@host# edit liveness-detection
Workarounds
This issue can be mitigated by disabling BFD liveness detection for DHCP subscribers.
Service can be restored by manually restarting the bbe-smgd process periodically.
Exploitation
Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.