CVE-2022-22168

MEDIUM

Juniper Junos < 19.1 - Memory Leak

Title source: rule
STIX 2.1

Description

An Improper Validation of Specified Type of Input vulnerability in the kernel of Juniper Networks Junos OS allows an unauthenticated adjacent attacker to trigger a Missing Release of Memory after Effective Lifetime vulnerability. Continued exploitation of this vulnerability will eventually lead to an FPC reboot and thereby a Denial of Service (DoS). This issue affects: Juniper Networks Junos OS on vMX and MX150: All versions prior to 19.2R1-S8, 19.2R3-S4; 19.3 versions prior to 19.3R3-S5; 19.4 versions prior to 19.4R2-S5, 19.4R3-S6; 20.1 versions prior to 20.1R3-S2; 20.2 versions prior to 20.2R3-S3; 20.3 versions prior to 20.3R3-S1; 20.4 versions prior to 20.4R3; 21.1 versions prior to 21.1R2-S1, 21.1R3; 21.2 versions prior to 21.2R1-S1, 21.2R2; 21.3 versions prior to 21.3R1-S1, 21.3R2.

Scores

CVSS v3 6.5
EPSS 0.0008
EPSS Percentile 22.5%
Attack Vector ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE
CWE-401 CWE-1287
Status published
Products (4)
juniper/junos 19.2 (15 CPE variants)
juniper/junos 19.3 (15 CPE variants)
juniper/junos 19.4 r1 (16 CPE variants)
juniper/junos 20.1 r1 (4 CPE variants)
Published Jan 19, 2022
Tracked Since Feb 18, 2026