CVE-2026-30873

Katalog CVE

CVSS 4.9 · Medium EPSS 0,65%

Kerentanan Missing Release of Memory after Effective Lifetime pada openwrt. Skor CVSS 3.1 4.9 (Medium) menurut NVD.

Deskripsi (NVD)

OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to both 24.10.6 and 25.12.1, the jp_get_token function, which performs lexical analysis by breaking input expressions into tokens, contains a memory leak vulnerability when extracting string literals, field labels, and regular expressions using dynamic memory allocation. These extracted results are stored in a jp_opcode struct, which is later copied to a newly allocated jp_opcode object via jp_alloc_op. During this transfer, if a string was previously extracted and stored in the initial jp_opcode, it is copied to the new allocation but the original memory is never freed, resulting in a memory leak. This issue has been fixed in versions 24.10.6 and 25.12.1.

Rincian

Terbit di NVD

19 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.9 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-401: Missing Release of Memory after Effective Lifetime

EPSS (30 hari)

0,65% peluang dieksploitasi; lebih tinggi dari 50,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openwrt/openwrt/security/advisories/GHSA-rcc6-v4r6-gj4m advisory vendor
• https://github.com/openwrt/openwrt/releases/tag/v24.10.6 release notes
• https://github.com/openwrt/openwrt/releases/tag/v25.12.1 release notes