Memory Leak in OpenWrt Project's Token Parsing Function

CVE-2026-30873

What is CVE-2026-30873?

The OpenWrt Project has identified a memory leak vulnerability in its Linux operating system, specifically within the jp_get_token function. This function is responsible for parsing input expressions and managing dynamic memory allocation. In versions prior to 24.10.6 and 25.12.1, a flaw exists where string literals and other elements extracted during this process are not properly freed, leading to a memory leak. When the extracted data is copied to a new memory allocation, the initial allocation remains unfreed if not handled correctly. This issue poses potential risks for resource consumption in embedded devices using the affected versions. The problem has been addressed in the latest releases, ensuring proper memory management.

References