Junos OS (SRX firewalls)
CVE-2026-33775: MX Series: Mismatch between configured and received packet types causes memory leak in bbe-smgd
A Missing Release of Memory after Effective Lifetime vulnerability in the BroadBand Edge subscriber management daemon (bbe-smgd) of Juniper Networks Junos OS on MX Series allows an adjacent, unauthenticated attacker to cause a Denial of Service (DoS).
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Junos OS (MX Series) 0 | 22.4R3-S8 or later |
| Junos OS (MX Series) 23.2 | 23.2R2-S5 or later |
| Junos OS (MX Series) 23.4 | 23.4R2-S6 or later |
| Junos OS (MX Series) 24.2 | 24.2R2-S2 or later |
| Junos OS (MX Series) 24.4 | 24.4R2 or later |
| Junos OS (MX Series) 25.2 | 25.2R2 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
A Missing Release of Memory after Effective Lifetime vulnerability in the BroadBand Edge subscriber management daemon (bbe-smgd) of Juniper Networks Junos OS on MX Series allows an adjacent, unauthenticated attacker to cause a Denial of Service (DoS).
If the authentication packet-type option is configured and a received packet does not match that packet type, the memory leak occurs. When all memory
available to bbe-smgd has been consumed, no new subscribers will be able to login.
The memory utilization of bbe-smgd can be monitored with the following show command:
user@host> show system processes extensive | match bbe-smgd
The below log message can be observed when this limit has been reached:
bbesmgd[<PID>]: %DAEMON-3-SMD_DPROF_RSMON_ERROR: Resource unavailability, Reason: Daemon Heap Memory exhaustion
This issue affects Junos OS on MX Series: * all versions before 22.4R3-S8, * 23.2 versions before 23.2R2-S5, * 23.4 versions before 23.4R2-S6, * 24.2 versions before 24.2R2-S2, * 24.4 versions before 24.4R2, * 25.2 versions before 25.2R2.
Am I affected?
A system is only affected, when packet-types is configured as follows:
[ interface <interface> auto-configure (stacked-)vlan-ranges dynamic-profile <profile-name> accept <packet-type1> ]
which allows packets of type 1 to be processed on receipt, but
[ interfaces <interface>auto-configure (stacked-)vlan-ranges authentication packet-types <packet-type2> ]
is a mismatch and doesn't require authentication for these packets.
Workarounds
There are no known workarounds for this issue.
Exploitation
Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.