OpenWRT up to 24.10.5/25.12.0 jp_get_token memory leak

Summaryinfo

A vulnerability was found in OpenWRT up to 24.10.5/25.12.0. It has been classified as problematic. Affected by this vulnerability is the function jp_get_token. The manipulation leads to memory leak. This vulnerability is listed as CVE-2026-30873. The attack must be carried out from within the local network. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in OpenWRT up to 24.10.5/25.12.0 and classified as problematic. This issue affects the function jp_get_token. The manipulation with an unknown input leads to a memory leak vulnerability. Using CWE to declare the problem leads to CWE-401. The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory. Impacted is availability. The summary by CVE is:

OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to both 24.10.6 and 25.12.1, the jp_get_token function, which performs lexical analysis by breaking input expressions into tokens, contains a memory leak vulnerability when extracting string literals, field labels, and regular expressions using dynamic memory allocation. These extracted results are stored in a jp_opcode struct, which is later copied to a newly allocated jp_opcode object via jp_alloc_op. During this transfer, if a string was previously extracted and stored in the initial jp_opcode, it is copied to the new allocation but the original memory is never freed, resulting in a memory leak. This issue has been fixed in versions 24.10.6 and 25.12.1.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-30873 since 03/06/2026. The exploitation is known to be easy. Access to the local network is required for this attack. Additional levels of successful authentication are necessary for exploitation. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 24.10.6 or 25.12.1 eliminates this vulnerability. The upgrade is hosted for download at github.com.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• OpenWRT

Version

• 24.10.0
• 24.10.1
• 24.10.2
• 24.10.3
• 24.10.4
• 24.10.5
• 25.0
• 25.1
• 25.2
• 25.3
• 25.4
• 25.5
• 25.6
• 25.7
• 25.8
• 25.9
• 25.10
• 25.11
• 25.12.0

Website

• Product: https://github.com/openwrt/openwrt/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion