Read the docs
TI-2022-06528 Aliases CVE-2022-22195GHSA-wm26-qf93-vqgf

Junos OS Evolved: Specific packets reaching the RE lead to a counter overflow and eventually a crash

Priority LOW 35CWE-911Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

An Improper Update of Reference Count vulnerability in the kernel of Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to trigger a counter overflow, eventually causing a Denial of Service (DoS). This issue affects Juniper Networks Junos OS Evolved: All versions prior to 20.4R3-S1-EVO; 21.1 versions prior to 21.1R3-EVO; 21.2 versions prior to 21.2R3-EVO; 21.3 versions prior to 21.3R2-EVO. This issue does not affect Juniper Networks Junos OS.

Why it matters now

EPSS 0.01056 64th percentileScored 2026-11-07
Fix Fixed Junos OS Evolved (Juniper Networks): 20.4R3-S1-EVO, 21.1R3-EVO, 21.2R3-EVO +1Junos OS (Juniper Networks): any

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
JuniperJunos OS Evolvedbefore 20.4R3-S1-EVO; 21.1 to before 21.1R3-EVO; 21.2 to before 21.2R3-EVO; 21.3 to before 21.3R2-EVO20.4R3-S1-EVO, 21.1R3-EVO, 21.2R3-EVO, 21.3R2-EVOPatch availableCNA
JuniperJunos OS—anyPatch availableCNA
  • Junos OS Evolved VendorJuniper Affected before 20.4R3-S1-EVO; 21.1 to before 21.1R3-EVO; 21.2 to before 21.2R3-EVO; 21.3 to before 21.3R2-EVO Fixed in 20.4R3-S1-EVO, 21.1R3-EVO, 21.2R3-EVO, 21.3R2-EVO Patch available CNA
  • Junos OS VendorJuniper Affected — Fixed in any Patch available CNA

CPE configurations NVD · 17

CPEVersionsRoleVendor
cpe:2.3:o:juniper:junos_os_evolved:*:*:*:*:*:*:*:*before 20.4VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:20.4:r1:*:*:*:*:*:*20.4 r1VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:20.4:r1-s1:*:*:*:*:*:*20.4 r1-s1VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:20.4:r1-s2:*:*:*:*:*:*20.4 r1-s2VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:20.4:r2:*:*:*:*:*:*20.4 r2VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:20.4:r2-s1:*:*:*:*:*:*20.4 r2-s1VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:20.4:r2-s2:*:*:*:*:*:*20.4 r2-s2VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:20.4:r2-s3:*:*:*:*:*:*20.4 r2-s3VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:20.4:r3:*:*:*:*:*:*20.4 r3VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:21.1:r1:*:*:*:*:*:*21.1 r1VulnerableJuniper
  • cpe:2.3:o:juniper:junos_os_evolved:*:*:*:*:*:*:*:* Versions before 20.4 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:20.4:r1:*:*:*:*:*:* Versions 20.4 r1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:20.4:r1-s1:*:*:*:*:*:* Versions 20.4 r1-s1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:20.4:r1-s2:*:*:*:*:*:* Versions 20.4 r1-s2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:20.4:r2:*:*:*:*:*:* Versions 20.4 r2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:20.4:r2-s1:*:*:*:*:*:* Versions 20.4 r2-s1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:20.4:r2-s2:*:*:*:*:*:* Versions 20.4 r2-s2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:20.4:r2-s3:*:*:*:*:*:* Versions 20.4 r2-s3 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:20.4:r3:*:*:*:*:*:* Versions 20.4 r3 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:21.1:r1:*:*:*:*:*:* Versions 21.1 r1 Vulnerable ·Juniper
Show 7 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:juniper:junos_os_evolved:21.1:r1-s1:*:*:*:*:*:*21.1 r1-s1VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:21.1:r2:*:*:*:*:*:*21.1 r2VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:21.2:r1:*:*:*:*:*:*21.2 r1VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:21.2:r1-s1:*:*:*:*:*:*21.2 r1-s1VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:21.2:r2:*:*:*:*:*:*21.2 r2VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:21.3:r1:*:*:*:*:*:*21.3 r1VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:21.3:r1-s1:*:*:*:*:*:*21.3 r1-s1VulnerableJuniper
  • cpe:2.3:o:juniper:junos_os_evolved:21.1:r1-s1:*:*:*:*:*:* Versions 21.1 r1-s1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:21.1:r2:*:*:*:*:*:* Versions 21.1 r2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:21.2:r1:*:*:*:*:*:* Versions 21.2 r1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:21.2:r1-s1:*:*:*:*:*:* Versions 21.2 r1-s1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:21.2:r2:*:*:*:*:*:* Versions 21.2 r2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:21.3:r1:*:*:*:*:*:* Versions 21.3 r1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:21.3:r1-s1:*:*:*:*:*:* Versions 21.3 r1-s1 Vulnerable ·Juniper

Remediation

  • Fix · CNA Junos OS Evolved (Juniper Networks) Fixed in 20.4R3-S1-EVO, 21.1R3-EVO, 21.2R3-EVO, 21.3R2-EVO
  • Fix · CNA Junos OS (Juniper Networks) Fixed in any

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-22195
  2. 2026-10-03 Alias added: GHSA-wm26-qf93-vqgf

References

Advisory 1

  • TI-2026-17602 Junos OS Evolved: PTX Series: A vulnerability allows a unauthenticated, network-based attacker to execute code as root CVSS 4.0CRITICAL 9.3
  • TI-2026-17601 Junos OS and Junos OS Evolved: Configuration of a specific SSH option results in mgd crash CVSS 4.0MEDIUM 6.7
  • TI-2023-04136 Improper input validation in Juniper Junos OS CVSS 3.1HIGH 7.5
  • TI-2026-74215 Stack-based buffer overflow in Junos OS rpd triggered by BGP peers CVSS 4.0CRITICAL 9.3
  • TI-2026-74211 Authentication bypass in Juniper J-Web allows pre-auth CGI execution CVSS 4.0CRITICAL 9.3
  • TI-2021-00146 Junos OS and Junos OS Evolved: Upon receipt of a specific BGP FlowSpec message network traffic may be disrupted. CVSS 3.1CRITICAL 10.0
See all 249 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences