Description

Multiple memory leaks in openNDS before 11.0.0 allow an unauthenticated attacker on the captive portal network to exhaust all available memory on the device within minutes.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-28T02:16:21.200Z",
  "pubdate": "2026-08-28T02:16:21.200Z",
  "executiveSummary": "The openNDS captive portal software prior to version 11.0.0 contains multiple memory leak vulnerabilities. These flaws allow an unauthenticated attacker present on the captive portal network to trigger rapid, progressive memory consumption, ultimately leading to a complete system crash via resource exhaustion.\nThe vulnerability is classified as a memory leak, which facilitates a Denial of Service (DoS) condition. Because the service resides on the captive portal network, the attack vector is network-based and requires no authentication or administrative privileges. Any unauthenticated device connected to the network segment managed by openNDS can initiate the exploitation process.\nThe risk implication is critical for environments relying on openNDS for network access control, as the service can be rendered unavailable within minutes. The exploitation process is highly scalable, allowing an attacker to destabilize the gateway or router hosting the captive portal without specialized tooling beyond basic network connectivity. Organizations utilizing affected versions are at significant risk of service disruption.",
  "technicalDetails": "The vulnerability resides within the memory management logic of openNDS versions prior to 11.0.0. The root cause involves improper handling of client connection states or data structures during the captive portal handshake and authentication lifecycle, where allocated memory blocks associated with incoming requests are not correctly released back to the system heap upon session termination or failed authentication attempts.\nThe exploitation method relies on the attacker sending a sustained sequence of crafted requests to the captive portal daemon. By initiating numerous connections that fail to progress through the expected authentication flow or by triggering error conditions in the request parser, the attacker forces the application to allocate memory for state management that remains unreferenced and un-freed throughout the application's runtime.\nThe attack flow follows a repetitive pattern: (1) An unauthenticated attacker establishes a connection to the network segment protected by openNDS. (2) The attacker sends a high volume of requests designed to invoke the vulnerable code paths responsible for the identified memory leaks. (3) The openNDS process allocates heap memory to track these connections but fails to deallocate these chunks due to the flaw in the request lifecycle state machine. (4) As the process continues to accept requests, its RSS (Resident Set Size) increases monotonically.\nBecause these leaks are cumulative, the system will eventually hit the kernel's memory limits, triggering the OOM (Out of Memory) killer or causing the openNDS service to crash due to malloc failures. The attack is highly efficient, as the overhead required to trigger the leak is significantly smaller than the memory consumed per request, allowing an attacker to exhaust available system memory in a matter of minutes, depending on the available system resources and the frequency of the attack packets.\nThe vulnerable component is the openNDS daemon process itself, which operates as a bridge between unauthenticated clients and the wider network. The exposure is limited to the captive portal network interface; however, within that scope, the attack is trivial to execute, requiring no prior knowledge of the internal application state or administrative access. The post-exploitation impact is a total loss of captive portal functionality, effectively blocking legitimate users from authentication and internet access until the service is manually restarted."
}