CVE-2022-22226

In VxLAN scenarios on EX4300-MP, EX4600, QFX5000 Series devices an Uncontrolled Memory Allocation vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS allows an unauthenticated adjacently located attacker sending specific packets to cause a Denial of Service (DoS) condition by crashing one or more PFE's when they are received and processed by the device. Upon automatic restart of the PFE, continued processing of these packets will cause the memory leak to reappear. Depending on the volume of packets received the attacker may be able to create a sustained Denial of Service (DoS) condition. This issue affects: Juniper Networks Junos OS on EX4300-MP, EX4600, QFX5000 Series: 17.1 version 17.1R1 and later versions prior to 17.3R3-S12; 17.4 versions prior to 17.4R2-S13, 17.4R3-S5; 18.1 versions prior to 18.1R3-S13; 18.2 versions prior to 18.2R3-S8; 18.3 versions prior to 18.3R3-S5; 18.4 versions prior to 18.4R1-S8, 18.4R2-S6, 18.4R3-S6; 19.1 versions prior to 19.1R3-S4; 19.2 versions prior to 19.2R1-S7, 19.2R3-S1; 19.3 versions prior to 19.3R2-S6, 19.3R3-S1; 19.4 versions prior to 19.4R1-S4, 19.4R2-S4, 19.4R3-S1; 20.1 versions prior to 20.1R2; 20.2 versions prior to 20.2R2-S3, 20.2R3; 20.3 versions prior to 20.3R2. This issue does not affect Junos OS versions prior to 17.1R1.

• CWE-789
• CWE-770

• https://kb.juniper.net/JSA69876Vendor Advisory
• https://www.juniper.net/documentation/us/en/software/junos/ovsdb-vxlan/evpn-vxlan/topics/ref/statement/vxlan.html#id-vxlan__d281e31Vendor Advisory
• https://kb.juniper.net/JSA69876Vendor Advisory
• https://www.juniper.net/documentation/us/en/software/junos/ovsdb-vxlan/evpn-vxlan/topics/ref/statement/vxlan.html#id-vxlan__d281e31Vendor Advisory

Published

Oct 18, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-2222The Download Monitor WordPress plugin before 4.5.91 does not…4.9
• CVE-2022-22220A Time-of-check Time-of-use (TOCTOU) Race Condition vulnerab…5.9
• CVE-2022-22221An Improper Neutralization of Special Elements vulnerability…7.8
• CVE-2022-22223On QFX10000 Series devices using Juniper Networks Junos OS w…7.5
• CVE-2022-22224An Improper Check or Handling of Exceptional Conditions vuln…6.5
• CVE-2022-22225A Time-of-check Time-of-use (TOCTOU) Race Condition vulnerab…5.9
• CVE-2022-22227An Improper Check for Unusual or Exceptional Conditions vuln…5.3
• CVE-2022-22228An Improper Validation of Specified Type of Input vulnerabil…7.5
• CVE-2022-22229An Improper Neutralization of Input During Web Page Generati…8.4
• CVE-2022-2223The WordPress plugin Image Slider is vulnerable to Cross-Sit…4.3
• CVE-2022-22230An Improper Input Validation vulnerability in the Routing Pr…6.5
• CVE-2022-22231An Unchecked Return Value to NULL Pointer Dereference vulner…7.5