Vulnerability Details CVE-2026-30873
OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to both 24.10.6 and 25.12.1, the jp_get_token function, which performs lexical analysis by breaking input expressions into tokens, contains a memory leak vulnerability when extracting string literals, field labels, and regular expressions using dynamic memory allocation. These extracted results are stored in a jp_opcode struct, which is later copied to a newly allocated jp_opcode object via jp_alloc_op. During this transfer, if a string was previously extracted and stored in the initial jp_opcode, it is copied to the new allocation but the original memory is never freed, resulting in a memory leak. This issue has been fixed in versions 24.10.6 and 25.12.1.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 0.2%
CVSS Severity
CVSS v3 Score 4.9
References
Products affected by CVE-2026-30873
-
cpe:2.3:o:openwrt:openwrt:*
-
cpe:2.3:o:openwrt:openwrt:-
-
cpe:2.3:o:openwrt:openwrt:15.05.1
-
cpe:2.3:o:openwrt:openwrt:17.01.0
-
cpe:2.3:o:openwrt:openwrt:17.01.1
-
cpe:2.3:o:openwrt:openwrt:17.01.2
-
cpe:2.3:o:openwrt:openwrt:17.01.3
-
cpe:2.3:o:openwrt:openwrt:17.01.4
-
cpe:2.3:o:openwrt:openwrt:17.01.5
-
cpe:2.3:o:openwrt:openwrt:17.01.6
-
cpe:2.3:o:openwrt:openwrt:17.01.7
-
cpe:2.3:o:openwrt:openwrt:18.06.0
-
cpe:2.3:o:openwrt:openwrt:18.06.1
-
cpe:2.3:o:openwrt:openwrt:18.06.2
-
cpe:2.3:o:openwrt:openwrt:18.06.3
-
cpe:2.3:o:openwrt:openwrt:18.06.4
-
cpe:2.3:o:openwrt:openwrt:18.06.5
-
cpe:2.3:o:openwrt:openwrt:18.06.6
-
cpe:2.3:o:openwrt:openwrt:18.06.7
-
cpe:2.3:o:openwrt:openwrt:18.06.8
-
cpe:2.3:o:openwrt:openwrt:18.06.9
-
cpe:2.3:o:openwrt:openwrt:19.07.0
-
cpe:2.3:o:openwrt:openwrt:19.07.1
-
cpe:2.3:o:openwrt:openwrt:19.07.10
-
cpe:2.3:o:openwrt:openwrt:19.07.2
-
cpe:2.3:o:openwrt:openwrt:19.07.3
-
cpe:2.3:o:openwrt:openwrt:19.07.4
-
cpe:2.3:o:openwrt:openwrt:19.07.5
-
cpe:2.3:o:openwrt:openwrt:19.07.6
-
cpe:2.3:o:openwrt:openwrt:19.07.7
-
cpe:2.3:o:openwrt:openwrt:19.07.8
-
cpe:2.3:o:openwrt:openwrt:19.07.9
-
cpe:2.3:o:openwrt:openwrt:21.02
-
cpe:2.3:o:openwrt:openwrt:21.02.0
-
cpe:2.3:o:openwrt:openwrt:21.02.1
-
cpe:2.3:o:openwrt:openwrt:21.02.2
-
cpe:2.3:o:openwrt:openwrt:21.02.3
-
cpe:2.3:o:openwrt:openwrt:21.02.4
-
cpe:2.3:o:openwrt:openwrt:21.02.5
-
cpe:2.3:o:openwrt:openwrt:21.02.6
-
cpe:2.3:o:openwrt:openwrt:21.02.7
-
cpe:2.3:o:openwrt:openwrt:22.03.0
-
cpe:2.3:o:openwrt:openwrt:22.03.1
-
cpe:2.3:o:openwrt:openwrt:22.03.2
-
cpe:2.3:o:openwrt:openwrt:22.03.3
-
cpe:2.3:o:openwrt:openwrt:22.03.4
-
cpe:2.3:o:openwrt:openwrt:22.03.5
-
cpe:2.3:o:openwrt:openwrt:22.03.6
-
cpe:2.3:o:openwrt:openwrt:22.03.7
-
cpe:2.3:o:openwrt:openwrt:23.05.0
-
cpe:2.3:o:openwrt:openwrt:23.05.1
-
cpe:2.3:o:openwrt:openwrt:23.05.2
-
cpe:2.3:o:openwrt:openwrt:23.05.3
-
cpe:2.3:o:openwrt:openwrt:23.05.4
-
cpe:2.3:o:openwrt:openwrt:23.05.5
-
cpe:2.3:o:openwrt:openwrt:23.05.6
-
cpe:2.3:o:openwrt:openwrt:24.10.0
-
cpe:2.3:o:openwrt:openwrt:24.10.1
-
cpe:2.3:o:openwrt:openwrt:24.10.2
-
cpe:2.3:o:openwrt:openwrt:24.10.3
-
cpe:2.3:o:openwrt:openwrt:24.10.4