CVE-2022-22174

Junos OS: QFX5000 Series, EX4600: Device may run out of memory, causing traffic loss, upon receipt of specific IPv6 packets

HIGH

7.5

CVSS Score

Published: January 19, 2022 at 12:21 AM UTC

Updated: June 17, 2026 at 04:27 AM UTC

12 products affected across 2 vendorsJunosQfx5200Qfx5110

Using Junos OS by Juniper Networks?

Get instant alerts when new vulnerabilities affect Junos OS - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.5

Exploit prediction

EPSS 0.9%

Description

A vulnerability in the processing of inbound IPv6 packets in Juniper Networks Junos OS on QFX5000 Series and EX4600 switches may cause the memory to not be freed, leading to a packet DMA memory leak, and eventual Denial of Service (DoS) condition. Once the condition occurs, further packet processing will be impacted, creating a sustained Denial of Service (DoS) condition. The following error logs may be observed using the "show heap" command and the device may eventually run out of memory if such packets are received continuously. Jan 12 12:00:00 device-name fpc0 (buf alloc) failed allocating packet buffer Jan 12 12:00:01 device-name fpc0 (buf alloc) failed allocating packet buffer user@device-name> request pfe execute target fpc0 timeout 30 command "show heap" ID Base Total(b) Free(b) Used(b) % Name -- ---------- ----------- ----------- ----------- --- ----------- 0 246fc1a8 536870488 353653752 183216736 34 Kernel 1 91800000 16777216 12069680 4707536 28 DMA 2 92800000 75497472 69997640 5499832 7 PKT DMA DESC 3 106fc000 335544320 221425960 114118360 34 Bcm_sdk 4 97000000 176160768 200 176160568 99 Packet DMA <<<<<<<<<<<<<< 5 903fffe0 20971504 20971504 0 0 Blob This issue affects Juniper Networks Junos OS on QFX5000 Series, EX4600: 18.3R3 versions prior to 18.3R3-S6; 18.4 versions prior to 18.4R2-S9, 18.4R3-S9; 19.1 versions prior to 19.1R2-S3, 19.1R3-S7; 19.2 versions prior to 19.2R1-S8, 19.2R3-S3; 19.3 versions prior to 19.3R2-S7, 19.3R3-S4; 19.4 versions prior to 19.4R2-S5, 19.4R3-S6; 20.1 versions prior to 20.1R3-S1; 20.2 versions prior to 20.2R3-S2; 20.3 versions prior to 20.3R3-S1; 20.4 versions prior to 20.4R3; 21.1 versions prior to 21.1R2-S1, 21.1R3; 21.2 versions prior to 21.2R1-S1, 21.2R2. This issue does not affect Juniper Networks Junos OS: Any versions prior to 17.4R3; 18.1 versions prior to 18.1R3-S6; 18.2 versions prior to 18.2R3; 18.3 versions prior to 18.3R3; 18.4 versions prior to 18.4R2; 19.1 versions prior to 19.1R2.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Junos · Juniper Networks

95%

18.3 ≤ v < 18.3R3-S618.4 ≤ v < 18.4R2-S9, 18.4R3-S919.1 ≤ v < 19.1R2-S3, 19.1R3-S719.2 ≤ v < 19.2R1-S8, 19.2R3-S319.3 ≤ v < 19.3R2-S7, 19.3R3-S419.4 ≤ v < 19.4R2-S5, 19.4R3-S620.1 ≤ v < 20.1R3-S120.2 ≤ v < 20.2R3-S220.3 ≤ v < 20.3R3-S120.4 ≤ v < 20.4R321.1 ≤ v < 21.1R2-S1, 21.1R321.2 ≤ v < 21.2R1-S1, 21.2R218.3 18.3 r1 18.3 r1-s1 18.3 r1-s2 18.3 r1-s3 18.3 r1-s4 18.3 r1-s5 18.3 r1-s6 18.3 r2 18.3 r2-s1 18.3 r2-s2 18.3 r2-s3 18.3 r2-s4 18.3 r3 18.3 r3-s1 18.3 r3-s2 18.3 r3-s3 18.3 r3-s4 18.3 r3-s5 18.4 18.4 r1 18.4 r1-s1 18.4 r1-s2 18.4 r1-s3 18.4 r1-s4 18.4 r1-s5 18.4 r1-s6 18.4 r1-s7 18.4 r2 18.4 r2-s1 18.4 r2-s2 18.4 r2-s3 18.4 r2-s4 18.4 r2-s5 18.4 r2-s6 18.4 r2-s7 18.4 r2-s8 18.4 r3 18.4 r3-s1 18.4 r3-s2 18.4 r3-s3 18.4 r3-s4 18.4 r3-s5 18.4 r3-s6 18.4 r3-s7 18.4 r3-s8 19.1 19.1 r1 19.1 r1-s1 19.1 r1-s2 19.1 r1-s3 19.1 r1-s4 19.1 r1-s5 19.1 r1-s6 19.1 r2 19.1 r2-s1 19.1 r2-s2 19.1 r3 19.1 r3-s1 19.1 r3-s2 19.1 r3-s3 19.1 r3-s4 19.1 r3-s5 19.1 r3-s6 19.2 19.2 r1 19.2 r1-s1 19.2 r1-s2 19.2 r1-s3 19.2 r1-s4 19.2 r1-s5 19.2 r1-s6 19.2 r1-s7 19.2 r3 19.2 r3-s1 19.2 r3-s2 19.2 r3-s3 19.3 19.3 r1 19.3 r1-s1 19.3 r2 19.3 r2-s1 19.3 r2-s2 19.3 r2-s3 19.3 r2-s4 19.3 r2-s5 19.3 r2-s6 19.3 r3 19.3 r3-s1 19.3 r3-s2 19.3 r3-s3 19.4 19.4 r1 19.4 r1-s1 19.4 r1-s2 19.4 r1-s3 19.4 r1-s4 19.4 r2 19.4 r2-s1 19.4 r2-s2 19.4 r2-s3 19.4 r2-s4 19.4 r3 19.4 r3-s1 19.4 r3-s2 19.4 r3-s3 19.4 r3-s4 19.4 r3-s5 20.1 20.1 r1 20.1 r1-s1 20.1 r1-s2 20.1 r1-s3 20.1 r1-s4 20.1 r2 20.1 r2-s1 20.1 r2-s2 20.1 r3 20.2 20.2 r1 20.2 r1-s1 20.2 r1-s2 20.2 r1-s3 20.2 r2 20.2 r2-s1 20.2 r2-s2 20.2 r2-s3 20.2 r3 20.2 r3-s1 20.3 20.3 r1 20.3 r1-s1 20.3 r2 20.3 r2-s1 20.3 r3 20.4 20.4 r1 20.4 r1-s1 20.4 r2 20.4 r2-s1 20.4 r2-s2 21.1 21.1 r1 21.1 r1-s1 21.1 r2 21.2 21.2 r1

Vendor states this is fixed in 17.4R3 (unaffected)

Vendor states this is fixed in 18.1 (unaffected)

Vendor states this is fixed in 18.2 (unaffected)

Vendor states this is fixed in 18.3 (unaffected)

Affected range stops below 18.3R3-S6, so it looks safe — our inference, not a vendor statement

Vendor states this is fixed in 18.4 (unaffected)

Affected range stops below 18.4R2-S9, 18.4R3-S9, so it looks safe — our inference, not a vendor statement

Vendor states this is fixed in 19.1 (unaffected)

Affected range stops below 19.1R2-S3, 19.1R3-S7, so it looks safe — our inference, not a vendor statement

Affected range stops below 19.2R1-S8, 19.2R3-S3, so it looks safe — our inference, not a vendor statement

Affected range stops below 19.3R2-S7, 19.3R3-S4, so it looks safe — our inference, not a vendor statement

Affected range stops below 19.4R2-S5, 19.4R3-S6, so it looks safe — our inference, not a vendor statement

Affected range stops below 20.1R3-S1, so it looks safe — our inference, not a vendor statement

Affected range stops below 20.2R3-S2, so it looks safe — our inference, not a vendor statement

Affected range stops below 20.3R3-S1, so it looks safe — our inference, not a vendor statement

Affected range stops below 20.4R3, so it looks safe — our inference, not a vendor statement

Affected range stops below 21.1R2-S1, 21.1R3, so it looks safe — our inference, not a vendor statement

Affected range stops below 21.2R1-S1, 21.2R2, so it looks safe — our inference, not a vendor statement

juniper-ex4600 (environment) · juniper-ex4600-vc (environment) · juniper-ex4650 (environment) · juniper-qfx5100 (environment) · juniper-qfx5110 (environment) · juniper-qfx5120 (environment) · juniper-qfx5130 (environment) · juniper-qfx5200 (environment) · juniper-qfx5210 (environment) · juniper-qfx5220 (environment) · juniper-qfx5700 (environment)

Ex4600 · Juniperdevice

80%

All versions

Ex4600-Vc · Juniperdevice

80%

All versions

Ex4650 · Juniperdevice

80%

All versions

Qfx5100 · Juniperdevice

80%

All versions