SB2026070870 - Denial of service in unos OS and Junos OS Evolved SNMPv3

Description

This security bulletin contains information about 1 vulnerability.

1) Out-of-bounds write (CVE-ID: CVE-2026-33799)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds write in the SNMP daemon (snmpd) when processing specific valid SNMPv3 queries. A remote attacker can send specific valid SNMPv3 queries to cause a denial of service.

SNMPv3 must be configured for exploitation. Continuous receipt of the queries can exhaust snmpd process memory, leading to a crash and restart and impacting SNMP-based monitoring.

Remediation

Install update from vendor's website.

References

• https://supportportal.juniper.net/s/article/2026-07-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-Receipt-of-a-specific-SNMPv3-request-results-in-memory-leak-and-eventual-snmpd-crash-CVE-2026-33799
• https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H