Medium6.5Juniper Networks

Medium [CVE-2026-33800] Unchecked Input for Loop Condition vulnerability in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS on MX Series allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS).Micro-BFD session flaps generate respective up/down events which are queued by PFEMAN for processing

This medium-severity Juniper Networks advisory covers CVE-2026-33800 affecting Junos OS.

CVE-2026-33800 Published Jul 9, 2026Updated by vendor Jul 20, 2026

CVE-2026-33800

Affected products & platforms

Juniper NetworksJunosMX304

Open vendor advisory

Android app · Google Play

Monitor future Juniper Networks CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery

Get CVE alerts See app features

Summary

An Unchecked Input for Loop Condition vulnerability in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS on MX Series allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS).Micro-BFD session flaps generate respective up/down events which are queued by PFEMAN for processing.

Especially in a Virtual-Chassis (VC) scenario with locality‑bias configured, processing takes a significant amount of time for each event. If these sessions keep flapping, new events are constantly added, and in turn PFEMAN never completes processing these events.

This results in the PFEMAN watchdog timer expiring, which causes the FPC to crash and restart, representing a complete service outage.

This issue only affects MX series FPCs up to and including MPC9, and LC2101/2103 and LC480. It does not affect MPC10/11, LC4800/9600, and MX304.

all versions before 23.2R2-S7,
23.4 versions before 23.4R2-S8,

Affected versions

* all versions before 23

Official advisory · high-confidence parse· fetched 1 month ago·verify at source

Fixed versions

23.2R2-S7
23.4R2-S8
24.2R2-S4
24.4R2-S3
25.2R2

Official advisory · high-confidence parse· fetched 1 month ago·verify at source

Mitigation

Upgrade to a fixed release: 23.2R2-S7, 23.4R2-S8, 24.2R2-S4, 24.4R2-S3, 25.2R2. That is the remediation for this advisory.

The vendor advisory may list additional interim mitigations or workarounds not captured here — review it before change work.

Official advisory · high-confidence parse· fetched 1 month ago·verify at source

Sources

Official and corroborating records used to build this advisory.

CVE.org CNA affected-product recordCVE.org
Structured CNA affected[] data independently confirmed the affected product scope; native advisory content remains authoritative.
CVE Program
NVD discovery recordNVD
Independent discovery and scoring cross-reference. Vendor remediation guidance takes precedence. Discovered from the machine-readable feed https://services.nvd.nist.gov/rest/json/cves/2.0; this link opens the NVD record for CVE-2026-33800 instead of the raw feed document.
NIST National Vulnerability Database

Cross-references

Validate CVE metadata against the authoritative registries.

CVE-2026-33800NVD CVE.org MITRE

Official resources

Junos OS software downloads & install/upgrade (target: 23.2R2-S7 / 23.4R2-S8 / 24.2R2-S4)
Official documentation
This advisory names 23.2R2-S7 / 23.4R2-S8 / 24.2R2-S4 as the first fixed releases — official upgrade documentation for Junos OS on SRX / MX / EX / QFX.
Junos OS release & EOL / support dates
Release notes
Confirm your train is still supported and pick a fixed maintenance release.
Juniper Security Advisories portal
Official documentation
Canonical Juniper SIRT advisory portal — search here for the full JSA text and revisions.

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.