The vulnerability is a memory leak in the DHCP daemon jdhcpd on Juniper Networks Junos OS MX Series. Each subscriber logout during certain DHCPv6 scenarios leaves a small amount of memory unreleased, causing jdhcpd to consume more memory over time. When system memory is exhausted, jdhcpd crashes and restarts, resulting in a complete service outage for the junction that requires the process to recover. The weakness corresponds to CWE-401 (Memory Leak).

The flaw affects Junos OS on MX Series devices. All releases prior to 22.4R3‑S1, all 23.2 releases before 23.2R2, and all 23.4 releases before 23.4R2 are vulnerable. The documented scenarios involve DHCPv6 over PPPoE or DHCPv6 over VLAN with Active lease query or Bulk lease query.

The CVSS score of 8.7 signals a high severity risk, and the description indicates that an unauthenticated attacker who is adjacent to the network can trigger the leak by causing subscriber logouts in the affected DHCPv6 contexts. The absence of an EPSS score limits precise exploitation probability, but the straightforward use of DHCP logs and lack of defense in depth suggest that exploitation is feasible once the conditions are met. The issue is not listed in the CISA KEV catalog, so it is not a currently known exploited vulnerability in the wild. The impact is a complete denial of service for the jdhcpd process and any higher‑level services that rely on it.