CVE-2026-30873

OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to both 24.10.6 and 25.12.1, the jp_get_token function, which performs lexical analysis by breaking input expressions into tokens, contains a memory leak vulnerability when extracting string literals, field labels, and regular expressions using dynamic memory allocation. These extracted results are stored in a jp_opcode struct, which is later copied to a newly allocated jp_opcode object via jp_alloc_op. During this transfer, if a string was previously extracted and stored in the initial jp_opcode, it is copied to the new allocation but the original memory is never freed, resulting in a memory leak. This issue has been fixed in versions 24.10.6 and 25.12.1.

• CWE-401

• https://github.com/openwrt/openwrt/releases/tag/v24.10.6Release Notes
• https://github.com/openwrt/openwrt/releases/tag/v25.12.1Release Notes
• https://github.com/openwrt/openwrt/security/advisories/GHSA-rcc6-v4r6-gj4mVendor Advisory

Published

Mar 19, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-30868OPNsense is a FreeBSD based firewall and routing platform. P…8.1
• CVE-2026-30869SiYuan is a personal knowledge management system. Prior to 3…9.8
• CVE-2026-3087If `shutil.unpack_archive()` is given a ZIP archive with an …7.5
• CVE-2026-30870PowerSync Service is the server-side component of the PowerS…6.5
• CVE-2026-30871OpenWrt Project is a Linux operating system targeting embedd…9.8
• CVE-2026-30872OpenWrt Project is a Linux operating system targeting embedd…9.8
• CVE-2026-30874OpenWrt Project is a Linux operating system targeting embedd…7.8
• CVE-2026-30875Chamilo LMS is a learning management system. Prior to versio…8.8
• CVE-2026-30876Chamilo LMS is a learning management system. Prior to versio…5.3
• CVE-2026-30877baserCMS is a website development framework. Prior to versio…7.2
• CVE-2026-30878baserCMS is a website development framework. Prior to versio…5.3
• CVE-2026-30879baserCMS is a website development framework. Prior to versio…6.1