openwrt vulnerabilities

CVEs per yearBy the year they were published

1. 20192
2. 20241
3. 20252
4. 202633

Newest CVEs

• CVE-2026-55614

  uhttpd vulnerable to HTTP request smuggling via case-sensitive Transfer-Encoding matching

  openwrt · uhttpd

  Medium6.9
• CVE-2026-55612

  uhttpd vulnerable to HTTP request smuggling via invalid chunk-length state reset

  openwrt · uhttpd

  Low3.7
• CVE-2026-55613

  uhttpd: HTTP request smuggling via ubus POST body parse-error desync

  openwrt · uhttpd

  Medium6.9
• CVE-2026-55606

  odhcpd: Stack buffer overread via DUID length endianness mismatch in memcmp()

  openwrt · odhcpd

  Medium6.5
• CVE-2026-53918

  odhcpd DHCPv6 IA dangling first pointer use-after-free

  openwrt · odhcpd

  High8.8
• CVE-2026-53920

  odhcpd DHCPv6 Short IA_NA/IA_PD Body Stack Disclosure

  openwrt · odhcpd

  High8.7
• CVE-2026-53921

  odhcpd: Stack buffer overflow in DHCPv6 IA reply serialization (2 independent sites)

  openwrt · odhcpd

  Critical9.8
• CVE-2026-53922

  odhcpd: pre-auth remote DoS via size_t underflow in dhcpv6_ia_handle_IAs (stack BOF, canary-terminated)

  openwrt · odhcpd

  Medium6.5
• CVE-2026-55897

  luci-app-advanced-reboot read ACL exposes /bin/sh through file.exec, allowing delegated users to run commands as root

  openwrt · luci

  High8.8
• CVE-2026-55159

  luci-app-adblock-fast: Delegated `luci-app-adblock-fast` users can reach root command execution by injecting newline-separated cron entries

  openwrt · luci-app-adblock-fast

  High8.8