PT-2026-26382 · Unknown · Openwrt Project

Axelm-Tob · Publicado 2026-03-19 · Atualizado 2026-03-20 · CVE-2026-30873

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Média

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenWrt Project versions prior to 24.10.6 OpenWrt Project versions prior to 25.12.1

Description The OpenWrt Project, a Linux operating system for embedded devices, contains a memory leak in the jp get token function. This function handles lexical analysis by dividing input into tokens, specifically when processing string literals, field labels, and regular expressions using dynamic memory allocation. The issue occurs when memory allocated for extracted strings in a jp opcode struct is copied to a new jp opcode object via jp alloc op without freeing the original memory, leading to a memory leak.

Recommendations Update to OpenWrt Project version 24.10.6 or later. Update to OpenWrt Project version 25.12.1 or later.

Exploit

Correção

Memory Leak

Enumeração de Fraquezas

CWE-401

Identificadores relacionados

CVE-2026-30873

GHSA-RCC6-V4R6-GJ4M

Produtos afetados

Openwrt Project

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30873.json · Exploit
• https://github.com/openwrt/openwrt/releases/tag/v25.12.1 · Nota
• https://github.com/openwrt/openwrt/releases/tag/v24.10.6 · Nota
• https://github.com/openwrt/openwrt/security/advisories/GHSA-rcc6-v4r6-gj4m · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-30873 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2034891617979568299 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-30873 · Nota de Segurança