CVE-2026-38819

Published: Aug 28, 2026Modified: Sep 9, 2026Deferred

5.3

Vector

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 1.6 / Impact: 3.6

Source: MITRE (Secondary)

Description

Multiple memory leaks in openNDS before 11.0.0 allow an unauthenticated attacker on the captive portal network to exhaust all available memory on the device within minutes.

Related CWEs

CWE-401

Missing Release of Memory after Effective Lifetime

The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.

References (2)

https://github.com/openNDS/openNDS/commit/b2801d9f14af44a23be7e9a1c378623bc5947c4c

Source: cve@mitre.org

https://github.com/openNDS/openNDS/commit/f2332e68c6d34f8403db346e380fff3817020d5c

Source: cve@mitre.org

Timeline

No history available yet.