Riskcovery

CVE-2024-21617

Junos OS: BGP flap on NSR-enabled devices causes memory leak

State
Published
Severity
6.5 Medium
Published
Jan 12, 2024
Updated
Jun 17, 2025
Reserved
Dec 27, 2023

Read the record on cve.org

Description

An Incomplete Cleanup vulnerability in Nonstop active routing (NSR) component of Juniper Networks Junos OS allows an adjacent, unauthenticated attacker to cause memory leak leading to Denial of Service (DoS).

On all Junos OS platforms, when NSR is enabled, a BGP flap will cause memory leak. A manual reboot of the system will restore the services.

Note: NSR is not supported on the SRX Series and is therefore not affected by this vulnerability. The memory usage can be monitored using the below commands.

user@host> show chassis routing-engine no-forwarding user@host> show system memory | no-more This issue affects:

Juniper Networks Junos OS

* 21.2 versions earlier than 21.2R3-S5; * 21.3 versions earlier than 21.3R3-S4; * 21.4 versions earlier than 21.4R3-S4; * 22.1 versions earlier than 22.1R3-S2; * 22.2 versions earlier than 22.2R3-S2; * 22.3 versions earlier than 22.3R2-S1, 22.3R3; * 22.4 versions earlier than 22.4R1-S2, 22.4R2.

This issue does not affect Junos OS versions earlier than 20.4R3-S7.

Scores

CVSSScoreVectorSource
3.16.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hjuniper

Weaknesses

Affected Products

ProductVersions
Junos OSJuniper Networks
  • 21.2 to before 21.2R3-S5Affected
  • 21.3 to before 21.3R3-S4Affected
  • 21.4 to before 21.4R3-S4Affected
  • 22.1 to before 22.1R3-S2Affected
  • 22.2 to before 22.2R3-S2Affected
  • 22.3 to before 22.3R2-S1, 22.3R3Affected
  • 22.4 to before 22.4R1-S2, 22.4R2Affected
  • before 20.4R3-S7Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.