CVE-2026-33775
published 2026-04-09CVE-2026-33775: A Missing Release of Memory after Effective Lifetime vulnerability in the BroadBand Edge subscriber management daemon (bbe-smgd) of Juniper Networks Junos OS…
PriorityP430medium6.5CVSS 3.1
AVAACLPRNUINSUCNINAH
EPSS
0.19%
9.5th percentile
A Missing Release of Memory after Effective Lifetime vulnerability in the BroadBand Edge subscriber management daemon (bbe-smgd) of Juniper Networks Junos OS on MX Series allows an adjacent, unauthenticated attacker to cause a Denial of Service (DoS).
If the authentication packet-type option is configured and a received packet does not match that packet type, the memory leak occurs. When all memory
available to bbe-smgd has been consumed, no new subscribers will be able to login.
The memory utilization of bbe-smgd can be monitored with the following show command:
user@host> show system processes extensive | match bbe-smgd
The below log message can be observed when this limit has been reached:
bbesmgd[]: %DAEMON-3-SMD_DPROF_RSMON_ERROR: Resource unavailability, Reason: Daemon Heap Memory exhaustion
This issue affects Junos OS on MX Series:
* all versions before 22.4R3-S8,
* 23.2 versions before 23.2R2-S5,
* 23.4 versions before 23.4R2-S6,
* 24.2 versions before 24.2R2-S2,
* 24.4 versions before 24.4R2,
* 25.2 versions before 25.2R2.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| juniper | junos | < 22.4 | 22.4 |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos_os | — | — |
| juniper | mx_series | — | — |
| juniper_networks | junos_os | < 22.4R3-S8 | 22.4R3-S8 |
| juniper_networks | junos_os | >= 23.2 < 23.2R2-S5 | 23.2R2-S5 |
| juniper_networks | junos_os | >= 23.4 < 23.4R2-S6 | 23.4R2-S6 |
| juniper_networks | junos_os | >= 24.2 < 24.2R2-S2 | 24.2R2-S2 |
| juniper_networks | junos_os | >= 24.4 < 24.4R2 | 24.4R2 |
| juniper_networks | junos_os | >= 25.2 < 25.2R2 | 25.2R2 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv4.07.1HIGHCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:M/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Juniper
CVE-2026-33775: A Missing Release of Memory after Effective Lifetime vulnerability in the BroadBand Edge subscriber management daemon (bbe-smgd) of Juniper Networks J
vendor_juniper·2026-04-09·CVSS 6.5
CVE-2026-33775 [MEDIUM] CWE-401 CVE-2026-33775: A Missing Release of Memory after Effective Lifetime vulnerability in the BroadBand Edge subscriber management daemon (bbe-smgd) of Juniper Networks J
CVE-2026-33775: A Missing Release of Memory after Effective Lifetime vulnerability in the BroadBand Edge subscriber management daemon (bbe-smgd) of Juniper Networks Junos OS on MX Series allows an adjacent, unauthenticated attacker to cause a Denial of Service (DoS).
If the authentication packet-type option is configured and a received packet does not match that packet type, the memory leak occurs. When all memory
available to bbe-smgd has been consumed, no new subscribers will be able to login.
The memory utilization of bbe-smgd can be monitored with the following show command:
user@host> show system processes extensive | match bbe-smgd
The below log message can be observed when this limit has been reached:
bbesmgd[]: %DAEMON-3-SMD_DPROF_RSMON_ERROR: Resource unavailability, Reason:
GHSA
GHSA-9p4v-567m-9ggg: A Missing Release of Memory after Effective Lifetime vulnerability in the BroadBand Edge subscriber management daemon (bbe-smgd) of Juniper Networks J
ghsa_unreviewed·2026-04-10
CVE-2026-33775 [HIGH] CWE-401 GHSA-9p4v-567m-9ggg: A Missing Release of Memory after Effective Lifetime vulnerability in the BroadBand Edge subscriber management daemon (bbe-smgd) of Juniper Networks J
A Missing Release of Memory after Effective Lifetime vulnerability in the BroadBand Edge subscriber management daemon (bbe-smgd) of Juniper Networks Junos OS on MX Series allows an adjacent, unauthenticated attacker to cause a Denial of Service (DoS).
If the authentication packet-type option is configured and a received packet does not match that packet type, the memory leak occurs. When all memory
available to bbe-smgd has been consumed, no new subscribers will be able to login.
The memory utilization of bbe-smgd can be monitored with the following show command:
user@host> show system processes extensive | match bbe-smgd
The below log message can be observed when this limit has been reached:
bbesmgd[]: %DAEMON-3-SMD_DPROF_RSMON_ERROR: Resource unavailability, Reason: Daemon Heap Mem
VulDB
Juniper Junos OS up to 25.2R1 on MX Log Message bbesmgd[] memory leak (JSA107821)
vuldb·2026-04-10·CVSS 7.1
CVE-2026-33775 [HIGH] Juniper Junos OS up to 25.2R1 on MX Log Message bbesmgd[] memory leak (JSA107821)
A vulnerability labeled as problematic has been found in Juniper Junos OS up to 25.2R1 on MX. Affected by this vulnerability is an unknown functionality of the component Log Message Handler. The manipulation of the argument bbesmgd[] results in memory leak.
This vulnerability is known as CVE-2026-33775. It is possible to launch the attack remotely. No exploit is available.
The affected component should be upgraded.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-04-09
Published