The vulnerability affects the OpenWrt JSONPath parser, where the jp_get_token function leaks memory while extracting string literals, field labels, and regular expressions. Dynamic memory allocation is used to store these extraction results in a jp_opcode structure. When the structure is subsequently copied to a new allocation via jp_alloc_op the original memory is never freed. This results in a memory leak that can accumulate over time, potentially exhausting system memory and causing a denial‑of‑service condition. The weakness is classified as CWE‑401 and CWE‑772, indicating an improper release and a code defect regarding resource management. The impact is limited to loss of memory resources; there is no direct compromise of confidentiality, integrity, or remote execution.

The affected product is the OpenWrt Linux operating system designed for embedded devices, under the OpenWrt Project. Versions prior to the releases 24.10.6 and 25.12.1 are vulnerable. Users running earlier builds of OpenWrt should be aware that these systems expose an unpatched JSONPath memory leak.

The CVSS score of 2.4 classifies the vulnerability as low severity, and the EPSS probability of less than 1% indicates a low likelihood of exploitation. It is not listed in the CISA KEV catalog. Exploitation would require repeated processing of crafted JSONPath expressions to bring the system to a state of memory exhaustion, thereby causing local denial of service. No remote code execution or privilege escalation is possible based on the available data. Overall, the risk is low, but escalation to a DoS attack is conceivable if the vulnerability is repeatedly triggered.