CVE-2026-30873 Details
Description
OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to both 24.10.6 and 25.12.1, the jp_get_token function, which performs lexical analysis by breaking input expressions into tokens, contains a memory leak vulnerability when extracting string literals, field labels, and regular expressions using dynamic memory allocation. These extracted results are stored in a jp_opcode struct, which is later copied to a newly allocated jp_opcode object via jp_alloc_op. During this transfer, if a string was previously extracted and stored in the initial jp_opcode, it is copied to the new allocation but the original memory is never freed, resulting in a memory leak. This issue has been fixed in versions 24.10.6 and 25.12.1.
A memory leak vulnerability has been identified in the OpenWrt Project's JSONPath implementation, specifically in versions prior to 24.10.6 and 25.12.1. The issue arises in the 'jp_get_token' function, which handles lexical analysis by breaking input expressions into tokens. When extracting string literals, field labels, and regular expressions, dynamic memory allocation is used. The extracted data is stored in a 'jp_opcode' struct, which is later copied to a new 'jp_opcode' object via 'jp_alloc_op'. However, if a string was previously extracted and stored in the original 'jp_opcode', it is copied to the new allocation without freeing the original memory, leading to a memory leak.
Users can upgrade to OpenWrt versions 24.10.6 or 25.12.1 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/openwrt/openwrt/releases/tag/v24.10.6 | [email protected] | Release Notes |
| https://github.com/openwrt/openwrt/releases/tag/v25.12.1 | [email protected] | Release Notes |
| https://github.com/openwrt/openwrt/security/advisories/GHSA-rcc6-v4r6-gj4m | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-401 | Missing Release of Memory after Effective Lifetime | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| openwrt openwrt | < 24.10.6 >= 25.12.0, < 25.12.1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 24, 2026 | Initial Analysis | [email protected] |
| Mar 19, 2026 | New CVE Received | [email protected] |