CVE-2018-0022

A Junos device with VPLS routing-instances configured on one or more interfaces may be susceptible to an mbuf leak when processing a specific MPLS packet. Approximately 1 mbuf is leaked per each packet processed. The number of mbufs is platform dependent. The following command provides the number of mbufs that are currently in use and maximum number of mbufs that can be allocated on a platform: > show system buffers 2437/3143/5580 mbufs in use (current/cache/total) Once the device runs out of mbufs it will become inaccessible and a restart will be required. This issue only affects end devices, transit devices are not affected. Affected releases are Juniper Networks Junos OS with VPLS configured running: 12.1X46 versions prior to 12.1X46-D76; 12.3X48 versions prior to 12.3X48-D66, 12.3X48-D70; 14.1 versions prior to 14.1R9; 14.1X53 versions prior to 14.1X53-D47; 14.2 versions prior to 14.2R8; 15.1 versions prior to 15.1F2-S19, 15.1F6-S10, 15.1R4-S9, 15.1R5-S7, 15.1R6-S4, 15.1R7; 15.1X49 versions prior to 15.1X49-D131, 15.1X49-D140; 15.1X53 versions prior to 15.1X53-D58 on EX2300/EX3400; 15.1X53 versions prior to 15.1X53-D233 on QFX5200/QFX5110; 15.1X53 versions prior to 15.1X53-D471 on NFX; 15.1X53 versions prior to 15.1X53-D66 on QFX10; 16.1 versions prior to 16.1R3-S8, 16.1R4-S6, 16.1R5; 16.2 versions prior to 16.2R1-S6, 16.2R2-S5, 16.2R3; 17.1 versions prior to 17.1R1-S7, 17.1R2-S6, 17.1R3; 17.2 versions prior to 17.2R1-S5, 17.2R2.

• CWE-400

• http://www.securityfocus.com/bid/103740Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1040790Third Party Advisory, VDB Entry
• https://kb.juniper.net/JSA10855Vendor Advisory
• http://www.securityfocus.com/bid/103740Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1040790Third Party Advisory, VDB Entry
• https://kb.juniper.net/JSA10855Vendor Advisory

Published

Apr 11, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-0016Receipt of a specially crafted Connectionless Network Protoc…9.8
• CVE-2018-0017A vulnerability in the Network Address Translation - Protoco…7.5
• CVE-2018-0018On SRX Series devices during compilation of IDP policies, an…7.5
• CVE-2018-0019A vulnerability in Junos OS SNMP MIB-II subagent daemon (mib…5.3
• CVE-2018-0020Junos OS may be impacted by the receipt of a malformed BGP U…7.5
• CVE-2018-0021If all 64 digits of the connectivity association name (CKN) …8.8
• CVE-2018-0023JSNAPy is an open source python version of Junos Snapshot Ad…5.5
• CVE-2018-0024An Improper Privilege Management vulnerability in a shell se…7.8
• CVE-2018-0025When an SRX Series device is configured to use HTTP/HTTPS pa…6.1
• CVE-2018-0026After Junos OS device reboot or upgrade, the stateless firew…4.7
• CVE-2018-0027Receipt of a crafted or malformed RSVP PATH message may caus…7.5
• CVE-2018-0029While experiencing a broadcast storm, placing the fxp0 inter…5.7