PT-2026-26382 · Unknown · Openwrt Project

Axelm-Tob · Published 2026-03-19 · Updated 2026-03-20 · CVE-2026-30873

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenWrt Project versions prior to 24.10.6 OpenWrt Project versions prior to 25.12.1

Description The OpenWrt Project, a Linux operating system for embedded devices, contains a memory leak in the jp get token function. This function handles lexical analysis by dividing input into tokens, specifically when processing string literals, field labels, and regular expressions using dynamic memory allocation. The issue occurs when memory allocated for extracted strings in a jp opcode struct is copied to a new jp opcode object via jp alloc op without freeing the original memory, leading to a memory leak.

Recommendations Update to OpenWrt Project version 24.10.6 or later. Update to OpenWrt Project version 25.12.1 or later.

Exploit

Fix

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

CVE-2026-30873

GHSA-RCC6-V4R6-GJ4M

Affected Products

Openwrt Project

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30873.json · Exploit
• https://github.com/openwrt/openwrt/security/advisories/GHSA-rcc6-v4r6-gj4m · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-30873 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30873 · Security Note
• https://github.com/openwrt/openwrt/releases/tag/v25.12.1 · Note
• https://github.com/openwrt/openwrt/releases/tag/v24.10.6 · Note
• https://twitter.com/CVEnew/status/2034891617979568299 · Twitter Post