Read the docs
TI-2022-06538 Aliases CVE-2022-22207GHSA-9ggh-wwvp-m5qw

Use after free in Juniper Junos OS

Priority LOW 34CWE-416Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-416 and the CVSS impact.

Summary

A Use After Free vulnerability in the Advanced Forwarding Toolkit (AFT) manager process (aftmand) of Juniper Networks Junos OS allows an unauthenticated networked attacker to cause a kernel crash due to intensive polling of Abstracted Fabric (AF) interface statistics and thereby a Denial of Service (DoS). Continued gathering of AF interface statistics will create a sustained Denial of Service (DoS) condition. This issue affects Juniper Networks Junos OS on MX Series: 20.1 versions later than 20.1R1; 20.2 versions prior to 20.2R3-S5; 20.3 versions prior to 20.3R3-S4; 20.4 versions prior to 20.4R3; 21.1 versions prior to 21.1R2; 21.2 versions prior to 21.2R2.

Why it matters now

EPSS 0.00784 56th percentileScored 2026-11-07
Fix Fixed Junos OS (Juniper Networks): 20.2R3-S5, 20.3R3-S4, 20.4R3 +2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
JuniperJunos OS20.1R1 and later; 20.2 to before 20.2R3-S5; 20.3 to before 20.3R3-S4; 20.4 to before 20.4R3; 21.1 to before 21.1R2; 21.2 to before 21.2R220.2R3-S5, 20.3R3-S4, 20.4R3, 21.1R2, 21.2R2Patch availableCNA
  • Junos OS VendorJuniper Affected 20.1R1 and later; 20.2 to before 20.2R3-S5; 20.3 to before 20.3R3-S4; 20.4 to before 20.4R3; 21.1 to before 21.1R2; 21.2 to before 21.2R2 Fixed in 20.2R3-S5, 20.3R3-S4, 20.4R3, 21.1R2, 21.2R2 Patch available CNA

CPE configurations NVD · 65

CPEVersionsRoleVendor
cpe:2.3:o:juniper:junos:20.1:r1-s1:*:*:*:*:*:*20.1 r1-s1VulnerableJuniper
cpe:2.3:o:juniper:junos:20.1:r1-s2:*:*:*:*:*:*20.1 r1-s2VulnerableJuniper
cpe:2.3:o:juniper:junos:20.1:r1-s3:*:*:*:*:*:*20.1 r1-s3VulnerableJuniper
cpe:2.3:o:juniper:junos:20.1:r1-s4:*:*:*:*:*:*20.1 r1-s4VulnerableJuniper
cpe:2.3:o:juniper:junos:20.1:r2:*:*:*:*:*:*20.1 r2VulnerableJuniper
cpe:2.3:o:juniper:junos:20.1:r2-s1:*:*:*:*:*:*20.1 r2-s1VulnerableJuniper
cpe:2.3:o:juniper:junos:20.1:r2-s2:*:*:*:*:*:*20.1 r2-s2VulnerableJuniper
cpe:2.3:o:juniper:junos:20.1:r3:*:*:*:*:*:*20.1 r3VulnerableJuniper
cpe:2.3:o:juniper:junos:20.1:r3-s1:*:*:*:*:*:*20.1 r3-s1VulnerableJuniper
cpe:2.3:o:juniper:junos:20.1:r3-s2:*:*:*:*:*:*20.1 r3-s2VulnerableJuniper
  • cpe:2.3:o:juniper:junos:20.1:r1-s1:*:*:*:*:*:* Versions 20.1 r1-s1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:20.1:r1-s2:*:*:*:*:*:* Versions 20.1 r1-s2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:20.1:r1-s3:*:*:*:*:*:* Versions 20.1 r1-s3 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:20.1:r1-s4:*:*:*:*:*:* Versions 20.1 r1-s4 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:20.1:r2:*:*:*:*:*:* Versions 20.1 r2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:20.1:r2-s1:*:*:*:*:*:* Versions 20.1 r2-s1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:20.1:r2-s2:*:*:*:*:*:* Versions 20.1 r2-s2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:20.1:r3:*:*:*:*:*:* Versions 20.1 r3 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:20.1:r3-s1:*:*:*:*:*:* Versions 20.1 r3-s1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:20.1:r3-s2:*:*:*:*:*:* Versions 20.1 r3-s2 Vulnerable ·Juniper
Show 55 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:juniper:junos:20.1:r3-s3:*:*:*:*:*:*20.1 r3-s3VulnerableJuniper
cpe:2.3:o:juniper:junos:20.2:-:*:*:*:*:*:*20.2VulnerableJuniper
cpe:2.3:o:juniper:junos:20.2:r1:*:*:*:*:*:*20.2 r1VulnerableJuniper
cpe:2.3:o:juniper:junos:20.2:r1-s1:*:*:*:*:*:*20.2 r1-s1VulnerableJuniper
cpe:2.3:o:juniper:junos:20.2:r1-s2:*:*:*:*:*:*20.2 r1-s2VulnerableJuniper
cpe:2.3:o:juniper:junos:20.2:r1-s3:*:*:*:*:*:*20.2 r1-s3VulnerableJuniper
cpe:2.3:o:juniper:junos:20.2:r2:*:*:*:*:*:*20.2 r2VulnerableJuniper
cpe:2.3:o:juniper:junos:20.2:r2-s1:*:*:*:*:*:*20.2 r2-s1VulnerableJuniper
cpe:2.3:o:juniper:junos:20.2:r2-s2:*:*:*:*:*:*20.2 r2-s2VulnerableJuniper
cpe:2.3:o:juniper:junos:20.2:r2-s3:*:*:*:*:*:*20.2 r2-s3VulnerableJuniper
cpe:2.3:o:juniper:junos:20.2:r3:*:*:*:*:*:*20.2 r3VulnerableJuniper
cpe:2.3:o:juniper:junos:20.2:r3-s1:*:*:*:*:*:*20.2 r3-s1VulnerableJuniper
cpe:2.3:o:juniper:junos:20.2:r3-s2:*:*:*:*:*:*20.2 r3-s2VulnerableJuniper
cpe:2.3:o:juniper:junos:20.2:r3-s3:*:*:*:*:*:*20.2 r3-s3VulnerableJuniper
cpe:2.3:o:juniper:junos:20.2:r3-s4:*:*:*:*:*:*20.2 r3-s4VulnerableJuniper
cpe:2.3:o:juniper:junos:20.3:-:*:*:*:*:*:*20.3VulnerableJuniper
cpe:2.3:o:juniper:junos:20.3:r1:*:*:*:*:*:*20.3 r1VulnerableJuniper
cpe:2.3:o:juniper:junos:20.3:r1-s1:*:*:*:*:*:*20.3 r1-s1VulnerableJuniper
cpe:2.3:o:juniper:junos:20.3:r1-s2:*:*:*:*:*:*20.3 r1-s2VulnerableJuniper
cpe:2.3:o:juniper:junos:20.3:r2:*:*:*:*:*:*20.3 r2VulnerableJuniper
cpe:2.3:o:juniper:junos:20.3:r2-s1:*:*:*:*:*:*20.3 r2-s1VulnerableJuniper
cpe:2.3:o:juniper:junos:20.3:r3:*:*:*:*:*:*20.3 r3VulnerableJuniper
cpe:2.3:o:juniper:junos:20.3:r3-s1:*:*:*:*:*:*20.3 r3-s1VulnerableJuniper
cpe:2.3:o:juniper:junos:20.3:r3-s2:*:*:*:*:*:*20.3 r3-s2VulnerableJuniper
cpe:2.3:o:juniper:junos:20.3:r3-s3:*:*:*:*:*:*20.3 r3-s3VulnerableJuniper
cpe:2.3:o:juniper:junos:20.4:-:*:*:*:*:*:*20.4VulnerableJuniper
cpe:2.3:o:juniper:junos:20.4:r1:*:*:*:*:*:*20.4 r1VulnerableJuniper
cpe:2.3:o:juniper:junos:20.4:r1-s1:*:*:*:*:*:*20.4 r1-s1VulnerableJuniper
cpe:2.3:o:juniper:junos:20.4:r2:*:*:*:*:*:*20.4 r2VulnerableJuniper
cpe:2.3:o:juniper:junos:20.4:r2-s1:*:*:*:*:*:*20.4 r2-s1VulnerableJuniper
cpe:2.3:o:juniper:junos:20.4:r2-s2:*:*:*:*:*:*20.4 r2-s2VulnerableJuniper
cpe:2.3:o:juniper:junos:21.1:-:*:*:*:*:*:*21.1VulnerableJuniper
cpe:2.3:o:juniper:junos:21.1:r1:*:*:*:*:*:*21.1 r1VulnerableJuniper
cpe:2.3:o:juniper:junos:21.1:r1-s1:*:*:*:*:*:*21.1 r1-s1VulnerableJuniper
cpe:2.3:o:juniper:junos:21.2:-:*:*:*:*:*:*21.2VulnerableJuniper
cpe:2.3:o:juniper:junos:21.2:r1:*:*:*:*:*:*21.2 r1VulnerableJuniper
cpe:2.3:o:juniper:junos:21.2:r1-s1:*:*:*:*:*:*21.2 r1-s1VulnerableJuniper
cpe:2.3:o:juniper:junos:21.2:r1-s2:*:*:*:*:*:*21.2 r1-s2VulnerableJuniper
cpe:2.3:h:juniper:mx10:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
cpe:2.3:h:juniper:mx10000:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
cpe:2.3:h:juniper:mx10003:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
cpe:2.3:h:juniper:mx10008:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
cpe:2.3:h:juniper:mx10016:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
cpe:2.3:h:juniper:mx104:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
cpe:2.3:h:juniper:mx150:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
cpe:2.3:h:juniper:mx2008:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
cpe:2.3:h:juniper:mx2010:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
cpe:2.3:h:juniper:mx2020:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
cpe:2.3:h:juniper:mx204:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
cpe:2.3:h:juniper:mx240:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
cpe:2.3:h:juniper:mx40:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
cpe:2.3:h:juniper:mx480:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
cpe:2.3:h:juniper:mx5:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
cpe:2.3:h:juniper:mx80:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
cpe:2.3:h:juniper:mx960:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
  • cpe:2.3:o:juniper:junos:20.1:r3-s3:*:*:*:*:*:* Versions 20.1 r3-s3 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:20.2:-:*:*:*:*:*:* Versions 20.2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:20.2:r1:*:*:*:*:*:* Versions 20.2 r1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:20.2:r1-s1:*:*:*:*:*:* Versions 20.2 r1-s1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:20.2:r1-s2:*:*:*:*:*:* Versions 20.2 r1-s2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:20.2:r1-s3:*:*:*:*:*:* Versions 20.2 r1-s3 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:20.2:r2:*:*:*:*:*:* Versions 20.2 r2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:20.2:r2-s1:*:*:*:*:*:* Versions 20.2 r2-s1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:20.2:r2-s2:*:*:*:*:*:* Versions 20.2 r2-s2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:20.2:r2-s3:*:*:*:*:*:* Versions 20.2 r2-s3 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:20.2:r3:*:*:*:*:*:* Versions 20.2 r3 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:20.2:r3-s1:*:*:*:*:*:* Versions 20.2 r3-s1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:20.2:r3-s2:*:*:*:*:*:* Versions 20.2 r3-s2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:20.2:r3-s3:*:*:*:*:*:* Versions 20.2 r3-s3 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:20.2:r3-s4:*:*:*:*:*:* Versions 20.2 r3-s4 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:20.3:-:*:*:*:*:*:* Versions 20.3 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:20.3:r1:*:*:*:*:*:* Versions 20.3 r1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:20.3:r1-s1:*:*:*:*:*:* Versions 20.3 r1-s1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:20.3:r1-s2:*:*:*:*:*:* Versions 20.3 r1-s2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:20.3:r2:*:*:*:*:*:* Versions 20.3 r2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:20.3:r2-s1:*:*:*:*:*:* Versions 20.3 r2-s1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:20.3:r3:*:*:*:*:*:* Versions 20.3 r3 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:20.3:r3-s1:*:*:*:*:*:* Versions 20.3 r3-s1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:20.3:r3-s2:*:*:*:*:*:* Versions 20.3 r3-s2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:20.3:r3-s3:*:*:*:*:*:* Versions 20.3 r3-s3 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:20.4:-:*:*:*:*:*:* Versions 20.4 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:20.4:r1:*:*:*:*:*:* Versions 20.4 r1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:20.4:r1-s1:*:*:*:*:*:* Versions 20.4 r1-s1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:20.4:r2:*:*:*:*:*:* Versions 20.4 r2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:20.4:r2-s1:*:*:*:*:*:* Versions 20.4 r2-s1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:20.4:r2-s2:*:*:*:*:*:* Versions 20.4 r2-s2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:21.1:-:*:*:*:*:*:* Versions 21.1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:21.1:r1:*:*:*:*:*:* Versions 21.1 r1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:21.1:r1-s1:*:*:*:*:*:* Versions 21.1 r1-s1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:21.2:-:*:*:*:*:*:* Versions 21.2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:21.2:r1:*:*:*:*:*:* Versions 21.2 r1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:21.2:r1-s1:*:*:*:*:*:* Versions 21.2 r1-s1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:21.2:r1-s2:*:*:*:*:*:* Versions 21.2 r1-s2 Vulnerable ·Juniper
  • cpe:2.3:h:juniper:mx10:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
  • cpe:2.3:h:juniper:mx10000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
  • cpe:2.3:h:juniper:mx10003:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
  • cpe:2.3:h:juniper:mx10008:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
  • cpe:2.3:h:juniper:mx10016:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
  • cpe:2.3:h:juniper:mx104:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
  • cpe:2.3:h:juniper:mx150:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
  • cpe:2.3:h:juniper:mx2008:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
  • cpe:2.3:h:juniper:mx2010:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
  • cpe:2.3:h:juniper:mx2020:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
  • cpe:2.3:h:juniper:mx204:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
  • cpe:2.3:h:juniper:mx240:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
  • cpe:2.3:h:juniper:mx40:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
  • cpe:2.3:h:juniper:mx480:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
  • cpe:2.3:h:juniper:mx5:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
  • cpe:2.3:h:juniper:mx80:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
  • cpe:2.3:h:juniper:mx960:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper

Remediation

  • Fix · CNA Junos OS (Juniper Networks) Fixed in 20.2R3-S5, 20.3R3-S4, 20.4R3, 21.1R2, 21.2R2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-22207
  2. 2026-10-03 Alias added: GHSA-9ggh-wwvp-m5qw

References

Advisory 1

  • TI-2023-18638 Junos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthenticated to… KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-01585 Out of Cycle Security Advisory: Junos OS: Security vulnerability in J-Web and web based (HTTP/HTTPS) services KEVCVSS 3.1CRITICAL 9.8
  • TI-2015-04610 Assertion failure in ISC BIND named via TKEY queries KEVCVSS 3.1HIGH 7.5
  • TI-2025-15550 Junos OS: An local attacker with shell access can execute arbitrary code KEVCVSS 4.0MEDIUM 6.7
  • TI-2023-18644 Junos OS: SRX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload and download arbitrary files KEVCVSS 3.1MEDIUM 5.3
  • TI-2023-18640 Junos OS: EX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload arbitrary files KEVCVSS 3.1MEDIUM 5.3
See all 792 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences