# CVE-2026-38819: openNDS memory leak denial of service

Source: https://junglewise.ai/threats/cve-2026-38819-opennds-memory-leak-denial-of-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-28. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-38819 · Severity: medium · CVSS 5.3 · Published 2026-08-28

openNDS is a captive portal software used to manage network access and authentication on guest networks. Multiple memory leaks in versions before 11.0.0 allow unauthenticated attackers on the portal network to exhaust all available memory on the device within minutes, causing a denial of service and disruption to network access for all users.

Technologies: [openNDS](https://junglewise.ai/threats/technologies/opennds). Vendors: [openNDS](https://junglewise.ai/threats/vendors/opennds).

## Quick answers

**Is CVE-2026-38819 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-38819 being exploited in the wild.

**How severe is CVE-2026-38819?** Medium severity, with a CVSS score of 5.3, published 28 August 2026.

**Which products and versions are affected?** openNDS before 11.0.0.

**Is there a fix for CVE-2026-38819?** A patch was published on 2026: Fixed in version 11.0.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-38819 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-38819?** Check whether you run openNDS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability consists of multiple memory leaks in openNDS before version 11.0.0, rooted in improper memory management—specifically the reuse of strtok buffers before they are fully consumed (as evidenced by commit b2801d9) and overwrite issues during preemptive authentication (commit f2332e6). An unauthenticated attacker present on the captive portal network can trigger these leaks through normal network interactions, causing memory to be consumed without being released. The attack requires no special privileges and can exhaust available memory on the portal device within minutes, resulting in denial of service. The fixes have been integrated into version 11.0.0 and later releases.

## Affected products

- openNDS openNDS before 11.0.0

## Timeline

- 2026-08-28: disclosed
- 2026: patched: Fixed in version 11.0.0

## References

- [https://github.com/openNDS/openNDS/commit/b2801d9f14af44a23be7e9a1c378623bc5947c4c](https://github.com/openNDS/openNDS/commit/b2801d9f14af44a23be7e9a1c378623bc5947c4c)
- [https://github.com/openNDS/openNDS/commit/f2332e68c6d34f8403db346e380fff3817020d5c](https://github.com/openNDS/openNDS/commit/f2332e68c6d34f8403db346e380fff3817020d5c)

## Related threats

- [openNDS command injection in client_params.sh](https://junglewise.ai/threats/cve-2026-38822-opennds-command-injection-in-client-params-sh)
- [openNDS heap-based buffer overflow in http_microhttpd](https://junglewise.ai/threats/cve-2026-38821-opennds-heap-based-buffer-overflow-in-http-microhttpd)
- [openNDS unauthenticated OS command injection in fas parameter](https://junglewise.ai/threats/cve-2026-38820-opennds-unauthenticated-os-command-injection-in-fas-parameter)