Junos OS (SRX firewalls)
CVE-2026-33799: Receipt of a specific SNMPv3 request results in memory leak and eventual snmpd crash
An Out-of-bounds Write vulnerability in the SNMP daemon (snmpd) of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated network-based attacker sending specific valid SNMPv3 queries to trigger a memory leak.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Junos OS 0 | 21.2R3-S8 or later |
| Junos OS 21.4 | 21.4R3-S7 or later |
| Junos OS 22.1 | 22.1R3-S6 or later |
| Junos OS 22.2 | 22.2R3-S4 or later |
| Junos OS 22.3 | 22.3R3-S3 or later |
| Junos OS 22.4 | 22.4R3-S2 or later |
| Junos OS 23.2 | 23.2R2 or later |
| Junos OS 23.4 | 23.4R2 or later |
| Junos OS Evolved 0 | 21.2R3-S8-EVO or later |
| Junos OS Evolved 21.4 | 21.4R3-S7-EVO or later |
| Junos OS Evolved 22.1 | 22.1* or later |
| Junos OS Evolved 22.2 | 22.2R3-S4-EVO or later |
| Junos OS Evolved 22.3 | 22.3R3-S3-EVO or later |
| Junos OS Evolved 22.4 | 22.4* or later |
| Junos OS Evolved 23.2 | 23.2R2-EVO or later |
| Junos OS Evolved 23.4 | 23.4R2-EVO or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
An Out-of-bounds Write vulnerability in the SNMP daemon (snmpd) of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated network-based attacker sending specific valid SNMPv3 queries to trigger a memory leak. Over time, continuous receipt of these queries will result in snmpd process memory exhaustion, resulting in a process crash and restart, impacting the ability to monitor the system via SNMP.
Memory usage can be monitored using the following command:
user@device> show system processes extensive | match snmpd
This issue affects:
Junos OS:
- all versions before 21.2R3-S8;
- from 21.4 before 21.4R3-S7;
- from 22.1 before 22.1R3-S6;
- from 22.2 before 22.2R3-S4;
- from 22.3 before 22.3R3-S3;
- from 22.4 before 22.4R3-S2;
- from 23.2 before 23.2R2;
- from 23.4 before 23.4R2.
Junos OS Evolved: * all versions before 21.2R3-S8-EVO; * from 21.4 before 21.4R3-S7-EVO; * all versions of 22.1-EVO, * from 22.2 before 22.2R3-S4-EVO; * from 22.3 before 22.3R3-S3-EVO; * all versions of 22.4-EVO, * from 23.2 before 23.2R2-EVO; * from 23.4 before 23.4R2-EVO.
Am I affected?
This issue requires that SNMPv3 be configured. For example:
[snmp engine-id use-default-ip-address] [snmp v3 usm local-engine user <username> authentication-<method> ...] [snmp v3 vacm security-to-group security-model usm security-name <name> group <group>] [snmp v3 vacm access group <group> default-context-prefix security-model usm security-level <level> ...]
Workarounds
There are no known workarounds for this issue.
To reduce the risk of malicious exploitation, use access lists or firewall filters to limit access to the device via SNMPv3 only from trusted hosts.
Exploitation
Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.