Vulnerability · Published Apr 9, 2025 · Assigned by juniper

CVE-2025-30647Junos OS: MX Series: Subscriber login/logout activity will lead to a memory leak

Medium 6.5

In plain English

A medium-severity memory leak in Junos OS from Juniper Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.2%top 83.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A Missing Release of Memory after Effective Lifetime vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on MX Series allows an unauthenticated adjacent attacker to cause a Denial-of-Service (DoS). In a subscriber management scenario, login/logout activity triggers a memory leak, and the leaked memory gradually increments and eventually results in a crash. user@host> show chassis fpc Temp CPU Utilization (%) CPU Utilization (%) Memory Utilization (%) Slot State (C) Total Interrupt 1min 5min 15min DRAM (MB) Heap Buffer 2 Online 36 10 0 9 8 9 32768 26 0 This issue affects Junos OS on MX Series: * All versions before 21.2R3-S9 * from 21.4 before 21.4R3-S10 * from 22.2 before 22.2R3-S6 * from 22.4 before 22.4R3-S5 * from 23.2 before 23.2R2-S3 * from 23.4 before 23.4R2-S3 * from 24.2 before 24.2R2.

Affected products (as reported)

Vendor	Product	Versions
Juniper Networks	Junos OS	0 – before 21.2R3-S921.4 – before 21.4R3-S1022.2 – before 22.2R3-S622.4 – before 22.4R3-S523.2 – before 23.2R2-S323.4 – before 23.4R2-S324.2 – before 24.2R2

Weakness: CWE-401 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://supportportal.juniper.net/JSA96457 vendor-advisory