CVE-2026-38821: openNDS Buffer Overflow Vulnerability

CVE-2026-38821 Overview

CVE-2026-38821 is a heap-based buffer overflow [CWE-122] in openNDS (open Network Demarcation Service) versions prior to 11.0.0. The flaw resides in src/http_microhttpd.c, where a query string buffer is allocated with insufficient size relative to its encoded content. An unauthenticated attacker on the captive portal network can trigger the overflow to crash the openNDS daemon or potentially achieve remote code execution. openNDS is widely deployed on OpenWrt-based routers and captive portal gateways for guest Wi-Fi authentication.

Critical Impact
Unauthenticated adjacent-network attackers can crash the captive portal daemon and potentially execute arbitrary code on affected gateway devices.

Affected Products

openNDS versions prior to 11.0.0
OpenWrt devices bundling vulnerable openNDS packages
Captive portal gateways relying on openNDS for guest network authentication

Discovery Timeline

2026-08-28 - CVE-2026-38821 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-38821

Vulnerability Analysis

The vulnerability originates in openNDS's HTTP handling code that processes captive portal query strings. The daemon allocates a heap buffer sized for the raw query length (QUERYMAXLEN = 8192) but then writes an encoded representation into that same buffer. Encoding expands the payload beyond the allocated size, producing a heap-based buffer overflow.

Because the vulnerable code path is reachable before authentication, any client associated with the captive portal Wi-Fi network can trigger it. The result is at minimum a denial of service by crashing the openNDS daemon, disrupting guest network authentication. Heap metadata corruption raises the possibility of remote code execution on the gateway, though exploitation complexity is elevated due to heap layout constraints on embedded targets.

Root Cause

The root cause is an allocation size mismatch. safe_calloc(QUERYMAXLEN) reserves 8192 bytes, but the query string is later encoded with a size multiplier. The encoded form can exceed the original buffer, and no bounds check prevents the overflow. The patch reallocates the buffer using ENC_QUERYSTR, which is defined as QUERYMAXLEN * 1.5, ensuring the encoded output fits.

Attack Vector

An attacker connects to the captive portal Wi-Fi network and issues crafted HTTP requests with an oversized or specifically shaped query string. The daemon processes the request, encodes the query, and writes past the allocated heap chunk. No credentials or user interaction are required.

// Patch in src/common.h - increase encoded query buffer sizing
 #define QUERYMAXLEN 8192
 
 /* Max length of a query string in bytes */
-#define ENC_QUERYSTR (QUERYMAXLEN * 1.333)
+#define ENC_QUERYSTR (QUERYMAXLEN * 1.5)

// Patch in src/http_microhttpd.c - allocate encoded-size buffer
-	querystr = safe_calloc(QUERYMAXLEN);
+	querystr = safe_calloc(ENC_QUERYSTR);

Source: openNDS commit 3b5f7ef4

Detection Methods for CVE-2026-38821

Indicators of Compromise

Unexpected openNDS daemon crashes or restarts logged in logread or system journal on OpenWrt gateways
HTTP requests to the captive portal containing unusually long or malformed query strings
Segmentation faults or heap corruption messages referencing http_microhttpd.c in kernel logs

Detection Strategies

Inventory OpenWrt and gateway appliances to identify openNDS versions below 11.0.0
Inspect captive portal HTTP access logs for query strings exceeding several kilobytes or containing encoded expansion patterns
Monitor process supervision (procd) events indicating repeated openNDS respawns

Monitoring Recommendations

Forward gateway syslog and openNDS logs to a centralized logging platform for correlation
Alert on daemon crash patterns tied to captive portal client sessions
Track wireless client associations that precede daemon instability to identify potential attackers

How to Mitigate CVE-2026-38821

Immediate Actions Required

Upgrade openNDS to version 11.0.0 or later on all affected gateways
Apply vendor firmware updates for OpenWrt-based devices bundling openNDS
Restrict captive portal network access to trusted physical zones where feasible

Patch Information

The fix is available in the upstream commit 3b5f7ef4, which redefines ENC_QUERYSTR in src/common.h and allocates the query buffer using the encoded size in src/http_microhttpd.c. Upgrade to openNDS 11.0.0 to receive the fix.

Workarounds

Disable the captive portal service on non-essential guest networks until patching is complete
Place an upstream reverse proxy or WAF that enforces query string length limits before requests reach openNDS
Segment guest Wi-Fi networks and rate-limit client HTTP requests to reduce exploit surface

bash

# Verify installed openNDS version on OpenWrt and upgrade
opkg list-installed | grep opennds
opkg update && opkg upgrade opennds

# Temporarily disable the service if a patch cannot be applied immediately
/etc/init.d/opennds stop
/etc/init.d/opennds disable