CVE-2022-22172

A Missing Release of Memory after Effective Lifetime vulnerability in the Layer-2 control protocols daemon (l2cpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a memory leak. Continued exploitation can lead to memory exhaustion and thereby a Denial of Service (DoS). This issue occurs when specific LLDP packets are received. The impact of the l2cpd cores is that if any of the stp protocols (rstp, mstp or vstp) is used then stp re-converges and traffic loss will occur during that time. Also if any services depend on LLDP state (like PoE or VoIP device recognition) then these will also be affected. The memory utilization of the L2CPd process can be monitored with the following command: user@host> show system processes extensive | match l2cpd 1234 root 52 0 521M 43412K RUN 1 4:02 34.47% l2cpd This issue affects: Juniper Networks Junos OS 18.4 version 18.4R2-S4 and later versions prior to 18.4R2-S10. 19.2 versions prior to 19.2R1-S8, 19.2R3-S4; 19.3 versions prior to 19.3R3-S5; 19.4 versions prior to 19.4R3-S7; 20.1 versions prior to 20.1R3-S3; 20.2 versions prior to 20.2R3-S2; 20.3 versions prior to 20.3R3-S1; 20.4 versions prior to 20.4R3; 21.1 versions prior to 21.1R2-S2, 21.1R3; 21.2 versions prior to 21.2R2; Juniper Networks Junos OS Evolved All versions prior to 20.4R3-S2-EVO; 21.1 version 21.1R1-EVO and later versions; 21.2 versions prior to 21.2R2-EVO. This issue does not affect: Juniper Networks Junos OS 19.1 version 19.1R1 and later versions.

• CWE-401

• https://kb.juniper.net/JSA11278Vendor Advisory
• https://kb.juniper.net/JSA11278Vendor Advisory

Published

Jan 19, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-22167A traffic classification vulnerability in Juniper Networks J…9.8
• CVE-2022-22168An Improper Validation of Specified Type of Input vulnerabil…6.5
• CVE-2022-22169An Improper Initialization vulnerability in the routing prot…5.9
• CVE-2022-2217Cross-site Scripting (XSS) - Generic in GitHub repository io…6.1
• CVE-2022-22170A Missing Release of Resource after Effective Lifetime vulne…7.5
• CVE-2022-22171An Improper Check for Unusual or Exceptional Conditions vuln…7.5
• CVE-2022-22173A Missing Release of Memory after Effective Lifetime vulnera…7.5
• CVE-2022-22174A vulnerability in the processing of inbound IPv6 packets in…7.5
• CVE-2022-22175An Improper Locking vulnerability in the SIP ALG of Juniper …7.5
• CVE-2022-22176An Improper Validation of Syntactic Correctness of Input vul…6.5
• CVE-2022-22177A release of illegal memory vulnerability in the snmpd daemo…7.5
• CVE-2022-22178A Stack-based Buffer Overflow vulnerability in the flow proc…7.5