OpenWrt Project jsonpath: Memory leak when processing strings, labels, and regexp tokens
Description
OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to both 24.10.6 and 25.12.1, the jp_get_token function, which performs lexical analysis by breaking input expressions into tokens, contains a memory leak vulnerability when extracting string literals, field labels, and regular expressions using dynamic memory allocation. These extracted results are stored in a jp_opcode struct, which is later copied to a newly allocated jp_opcode object via jp_alloc_op. During this transfer, if a string was previously extracted and stored in the initial jp_opcode, it is copied to the new allocation but the original memory is never freed, resulting in a memory leak. This issue has been fixed in versions 24.10.6 and 25.12.1.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3- github.com/openwrt/openwrt/releases/tag/v24.10.6mitrex_refsource_MISC
- github.com/openwrt/openwrt/releases/tag/v25.12.1mitrex_refsource_MISC
- github.com/openwrt/openwrt/security/advisories/GHSA-rcc6-v4r6-gj4mmitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.