CVE-2026-38819: openNDS Memory Leak DOS Vulnerability

CVE-2026-38819 Overview

CVE-2026-38819 describes multiple memory leaks in openNDS versions prior to 11.0.0. openNDS is an open-source captive portal solution commonly deployed on Wi-Fi hotspots and embedded network gateways. An unauthenticated attacker connected to the captive portal network can trigger the leaks repeatedly and exhaust all available memory on the affected device within minutes. The condition is tracked under CWE-401: Missing Release of Memory after Effective Lifetime.

Critical Impact
An adjacent attacker with no credentials can drive an openNDS gateway to memory exhaustion, causing denial of service on the captive portal and any hosts relying on it for network access.

Affected Products

openNDS versions prior to 11.0.0
Captive portal deployments using openNDS on OpenWrt and similar embedded Linux gateways
Wi-Fi hotspots and guest networks routing traffic through vulnerable openNDS instances

Discovery Timeline

2026-08-28 - CVE-2026-38819 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-38819

Vulnerability Analysis

The vulnerability stems from multiple code paths in openNDS that allocate heap memory but fail to release it after use. Because the captive portal daemon processes requests from any client on the attached network before authentication, an attacker can send crafted requests in a tight loop. Each request causes an incremental leak. Over minutes the process consumes all available memory, and the kernel OOM killer terminates openNDS or destabilizes the gateway.

Upstream commits identify two distinct leak sites. The first, addressed in commit b2801d9f, corrects buffer reuse in src/ndsctl_thread.c where a strtok buffer was released prematurely. The second, addressed in commit f2332e6, fixes overwrite of the ipclient and macclient allocations during preemptive authentication in src/auth.c, which orphaned prior allocations.

Root Cause

The defect is a classic [CWE-401] missing memory release. Allocation lifetimes are not aligned with request lifetimes, so error paths and code paths involving preemptive authentication or strtok parsing return without invoking free(). Repeated invocation compounds the leaked bytes until the device exhausts its constrained memory footprint.

Attack Vector

Exploitation requires network adjacency to the captive portal. An attacker associates with the Wi-Fi or wired segment served by openNDS and issues repeated unauthenticated requests that exercise the leaking code paths. No credentials, user interaction, or elevated privileges are required.

// Patch excerpt from src/auth.c and src/ndsctl_thread.c
// Introduces a second buffer (msg2) so the original strtok/msg
// allocation is not reused or overwritten before it is freed.
	unsigned long long int downloadquota = config->download_quota;
	char *libcmd;
	char *msg;
+	char *msg2;
	char *customdata;
	char *argcopy;
	const char *arg2;

Source: openNDS commit b2801d9f and openNDS commit f2332e6. The added msg2 variable lets the code retain the original strtok buffer until parsing completes, eliminating the leak.

Detection Methods for CVE-2026-38819

Indicators of Compromise

Rapid growth of resident set size for the opennds process observed via ps, top, or /proc/<pid>/status.
Kernel OOM killer log entries in dmesg or /var/log/messages naming opennds as the killed process.
Captive portal becoming unresponsive shortly after a new client associates and generates burst traffic.

Detection Strategies

Monitor per-process memory metrics on gateways running openNDS and alert on sustained upward slope over short intervals.
Correlate spikes in unauthenticated requests to the captive portal splash endpoint with process memory growth.
Track ndsctl status output for anomalies in client counts and authentication attempts from a single MAC or IP.

Monitoring Recommendations

Ship gateway syslog, dmesg, and process metrics to a centralized log store for retention and analysis.
Baseline normal memory usage of opennds per device model and alert on deviations beyond that baseline.
Alert on repeated openNDS restarts, which typically indicate OOM-driven crashes on constrained hardware.

How to Mitigate CVE-2026-38819

Immediate Actions Required

Upgrade openNDS to version 11.0.0 or later on all captive portal gateways.
Rebuild and redeploy OpenWrt or vendor firmware packages that bundle openNDS below 11.0.0.
Restrict captive portal network exposure to trusted physical areas until patched builds are deployed.

Patch Information

The fixes are included in openNDS 11.0.0. Relevant upstream changes are commit b2801d9f covering src/ndsctl_thread.c and commit f2332e6 covering src/auth.c. Operators should confirm downstream packages, such as OpenWrt feeds, incorporate both commits.

Workarounds

Rate-limit unauthenticated client requests to the captive portal at the firewall or with iptables connection limits.
Schedule periodic restarts of the opennds service to reclaim leaked memory until patching is complete.
Reduce the maximum number of preauthenticated clients allowed by openNDS to shrink the leak surface.

bash

# Temporary mitigation: cap new connections per client MAC to the captive portal
iptables -I INPUT -i br-lan -p tcp --dport 2050 -m conntrack \
  --ctstate NEW -m recent --set --name ondsflood
iptables -I INPUT -i br-lan -p tcp --dport 2050 -m conntrack \
  --ctstate NEW -m recent --update --seconds 10 --hitcount 20 \
  --name ondsflood -j DROP

# Watchdog: restart opennds if RSS exceeds 64 MB
*/5 * * * * root RSS=$(ps -o rss= -C opennds); \
  [ "${RSS:-0}" -gt 65536 ] && /etc/init.d/opennds restart