Ad

CVE-2026-30873

LOW CVSS 4.0: 2.4 EPSS 0.02%
Updated Mar 24, 2026
Openwrt
Parameter Value
CVSS 2.4 (LOW)
Affected Versions 25.12.0 — 25.12.1
Fixed In 24.10.6
Type CWE-401 (Memory Leak)
Vendor Openwrt
Public PoC No

OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to both 24.10.6 and 25.12.1, the jp_get_token function, which performs lexical analysis by breaking input expressions into tokens, contains a memory leak vulnerability when extracting string literals, field labels, and regular expressions using dynamic memory allocation. These extracted results are stored in a jp_opcode struct, which is later copied to a newly allocated jp_opcode object via jp_alloc_op.

During this transfer, if a string was previously extracted and stored in the initial jp_opcode, it is copied to the new allocation but the original memory is never freed, resulting in a memory leak. This issue has been fixed in versions 24.10.6 and 25.12.1.

Attack Parameters

Attack Vector
Adjacent
Requires local network access
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
High
Admin privileges needed
User Interaction
Active
User action required

Impact Assessment

Confidentiality
None
No data leak
Integrity
None
No data modification
Availability
Low
Partial disruption

CVSS Vector v4.0

Weakness Type (CWE)

Vulnerable Products 2

Configuration From (including) Up to (excluding)
Openwrt Openwrt
cpe:2.3:o:openwrt:openwrt:*:*:*:*:*:*:*:*
24.10.6
Openwrt Openwrt
cpe:2.3:o:openwrt:openwrt:*:*:*:*:*:*:*:*
25.12.0 25.12.1