CVE-2026-38819 in openNDS
Summary
by MITRE • 08/28/2026
Multiple memory leaks in openNDS before 11.0.0 allow an unauthenticated attacker on the captive portal network to exhaust all available memory on the device within minutes.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/28/2026
The vulnerability identified in versions of openNDS prior to release 11.0.0 represents a critical resource exhaustion flaw stemming from multiple distinct memory leak defects within the application's core processing logic. As an open-source captive portal software widely deployed for managing network access and authentication, openNDS is designed to intercept HTTP requests and redirect users to a login page before granting full internet connectivity. The architectural design requires continuous parsing of incoming packets and management of session states, which introduces complexity in memory allocation and deallocation routines. In the affected versions, specific code paths fail to properly release dynamically allocated memory structures after they have served their immediate purpose or when certain error conditions are encountered during request processing. This failure results in a gradual but steady accumulation of unreleased heap memory over time as the system handles legitimate user traffic.
From an operational perspective, this flaw allows any unauthenticated attacker positioned on the captive portal network segment to trigger these leaks through routine interaction with the service or via crafted requests that exploit specific parsing edge cases. Because openNDS typically runs on embedded devices such as routers and access points which often have constrained memory resources compared to standard servers, even a moderate rate of memory leakage can lead to rapid system degradation. An attacker does not require valid credentials or elevated privileges; they merely need network connectivity within the captive portal zone. By generating sufficient traffic that triggers the flawed code paths, an adversary can exhaust all available RAM on the device in a matter of minutes. This leads to a complete denial of service condition where the router becomes unresponsive, crashes, or reboots automatically due to out-of-memory conditions, effectively disrupting network availability for all users connected through that gateway.
The technical classification of this vulnerability aligns with CWE-401, which describes missing release of memory after effective usage, and CWE-789, concerning the general category of memory leaks in C/C++ applications where pointers are lost or references remain active without corresponding deallocation calls like free() or delete. In the context of attack frameworks such as MITRE ATT&CK, this behavior is consistent with techniques used to achieve Denial of Service by consuming system resources, specifically falling under resource exhaustion strategies that target application-level stability rather than network bandwidth saturation. The lack of authentication requirements for exploitation makes it particularly dangerous in public Wi-Fi environments or enterprise guest networks where the boundary between trusted and untrusted users relies solely on the captive portal mechanism itself.
Mitigation for this vulnerability requires an immediate upgrade to openNDS version 11.0.0 or later, where these specific memory management defects have been addressed through code reviews and patching of the affected allocation routines. For organizations unable to update immediately due to compatibility constraints with existing infrastructure, temporary mitigations include implementing strict rate limiting on unauthenticated HTTP requests at the network perimeter using firewall rules or intrusion prevention systems to reduce the volume of traffic that can trigger the leak before it causes critical resource depletion. Additionally, configuring automatic watchdog timers or memory monitoring scripts that detect abnormal RAM usage and restart the openNDS service process can serve as a compensating control to maintain availability until a permanent fix is applied. Regular security audits focusing on C/C++ code paths involving dynamic memory allocation are also recommended to prevent similar issues in future deployments of network authentication software.