{"cve":"CVE-2024-39548","nvd":{"published":"2024-07-11T17:15:14.730","modified":"2026-06-17T07:42:11.550","status":"Analyzed","description":"An Uncontrolled Resource Consumption vulnerability in the aftmand process of Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to consume memory resources, resulting in a Denial of Service (DoS) condition. The processes do not recover on their own and must be manually restarted.\n\nThis issue affects both IPv4 and IPv6. \n\nChanges in memory usage can be monitored using the following CLI command:\nuser@device> show system memory node <fpc slot> | grep evo-aftmann\nThis issue affects Junos OS Evolved: \n\n\n\n  *  All versions before 21.2R3-S8-EVO, \n  *  21.3 versions before 21.3R3-S5-EVO, \n  *  21.4 versions before 21.4R3-S5-EVO, \n  *  22.1 versions before 22.1R3-S4-EVO, \n  *  22.2 versions before 22.2R3-S4-EVO,\n  *  22.3 versions before 22.3R3-S3-EVO,\n  *  22.4 versions before 22.4R2-S2-EVO, 22.4R3-EVO, \n  *  23.2 versions before 23.2R1-S1-EVO, 23.2R2-EVO.","cvss_v4":{"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/R:U","score":7.1},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5},"cwes":["CWE-400"],"references":["https://supportportal.juniper.net/JSA83010","https://supportportal.juniper.net/JSA83010"],"products":["juniper:junos_os_evolved"],"source":"nvd","synced_at":"2026-10-19T21:52:42.518321223+00:00"},"epss":{"cve":"CVE-2024-39548","score":0.00491,"percentile":0.42207,"date":"2026-11-01"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}