Next OpenWrt minor releases (25.12.6 and 24.10.9)

Thu Oct 29 19:22:20 PDT 2026

I went through and reviewed the advisory list to determine which ones
have been fixed but the advisory has not been updated yet.

Subject: Published GitHub advisories with fixes already in tree

Hi Hauke,

I compared the published GitHub security advisories for
openwrt/openwrt, openwrt/luci,
openwrt/packages, and openwrt/uhttpd with the trees on master,
openwrt-25.12, and
openwrt-24.10, as of 29 Oct 2026. Routing has no published advisories.
Private reports
are not included.

The advisory pages below still have an empty patched-version field, or
still say "none
known". The code fix is already in git. Updating that field is an edit
on the advisory,
not a pull request.

Where a fix is in the tree
==========================

openwrt/openwrt
---------------

GHSA-jw5r-xhf5-2xcq (CVE-2026-62947, cgi-io download path). Fix: openwrt/cgi-io
72990b748987 (2026-06-27), "main: canonicalize download path before ACL check".
Packaged as cgi-io 2026-07-21 (31cb3c89) on the packages feed master,
openwrt-25.12,
and openwrt-24.10.
https://github.com/openwrt/openwrt/security/advisories/GHSA-jw5r-xhf5-2xcq

GHSA-hhmc-92hw-535f (CVE-2026-62948, DHCPv6 hostname in the lease
file). The odhcpd
fix is on all three OpenWrt branches. Master packages odhcpd
2026-10-28 (5f5f900a),
which contains 68f382690bfa, "statefiles: escape client hostnames in
the lease state
file". openwrt-25.12 packages odhcpd 5d7be43f8b9d (2026-06-27), the same change.
openwrt-24.10 carries it as
patches/0034-statefiles-escape-client-hostnames-in-the-lease-stat.patch via
67c5b71d77e5 (2026-07-11). That commit message names this GHSA. LuCI status and
network lease tables escape the hostname with %h on luci master and
openwrt-25.12
(55379d04fcc3, 2026-06-23). The status includes this on openwrt-24.10 as well.
https://github.com/openwrt/openwrt/security/advisories/GHSA-hhmc-92hw-535f

GHSA-9558-77jp-g3fw (CVE-2026-55490, ead integer underflow). The same
fix subject is
on all three branches, dated 2026-06-12: master 63c0767f3d02, openwrt-25.12
fda611d2751e, openwrt-24.10 3944c026aa7c, "ead: fix integer underflow in
handle_send_a()".
https://github.com/openwrt/openwrt/security/advisories/GHSA-9558-77jp-g3fw

openwrt/uhttpd
--------------

These three name 1b624f8 as the end of the affected range. That commit is "auth:
classify $p$ lookups by account state". The fixes below are later, and
all three are
ancestors of the uhttpd snapshot packaged on OpenWrt master (ca796d7,
2026-10-19) and
openwrt-25.12 (373145f, 2026-08-24). openwrt-24.10 still packages
uhttpd 2025-07-06
and carries the same three fixes as quilt patches.

GHSA-mcfg-c4r7-pjpf (CVE-2026-55614, Transfer-Encoding). ae015e099986
(2026-06-13),
"client: reject unhandled Transfer-Encoding values". On 24.10:
patches/0015-client-reject-unhandled-Transfer-Encoding-values.patch.
https://github.com/openwrt/uhttpd/security/advisories/GHSA-mcfg-c4r7-pjpf

GHSA-p55c-rmhc-qfm5 (CVE-2026-55612, chunk length). b78f51847879 (2026-06-13),
"client: close connection on invalid chunk length". On 24.10:
patches/0016-client-close-connection-on-invalid-chunk-length.patch.
https://github.com/openwrt/uhttpd/security/advisories/GHSA-p55c-rmhc-qfm5

GHSA-wgwp-64hh-f52p (CVE-2026-55613, ubus POST body). 7b1bec45826b (2026-06-13),
"ubus: close connection on POST body parse error". On 24.10:
patches/0017-ubus-close-connection-on-POST-body-parse-error.patch.
https://github.com/openwrt/uhttpd/security/advisories/GHSA-wgwp-64hh-f52p

The next five are in that same 25.12/master uhttpd snapshot. They are not in the
openwrt-24.10 patch series, which stops at 0017. The 25.12.6
announcement already
lists them.

GHSA-vhx4-3p5q-m59q (CVE-2026-102338, header accumulation).
f6c2fcfa539d (2026-07-22),
"client: cap cumulative header count and bytes per request".
https://github.com/openwrt/uhttpd/security/advisories/GHSA-vhx4-3p5q-m59q

GHSA-2mpg-6wp5-435p (params type in POST /ubus/call/). e76736e5676f
(2026-08-03),
"ubus: guard params type in uh_ubus_send_request()".
https://github.com/openwrt/uhttpd/security/advisories/GHSA-2mpg-6wp5-435p

GHSA-83vv-qrc6-h3hx (url_path leak). 42e30caa704e (2026-08-03), "ubus:
set d->free
unconditionally to fix url_path leak".
https://github.com/openwrt/uhttpd/security/advisories/GHSA-83vv-qrc6-h3hx

GHSA-c2wg-hcff-hqrm (unread body on keep-alive). d6205aad6176
(2026-08-03), "client:
move unread-body guard into uh_request_done()".
https://github.com/openwrt/uhttpd/security/advisories/GHSA-c2wg-hcff-hqrm

GHSA-wvgh-cm54-q6f6 (subscribe refcount). 3c48b9e17d20 (2026-08-03),
"ubus: release
client refcount on successful /ubus/subscribe".
https://github.com/openwrt/uhttpd/security/advisories/GHSA-wvgh-cm54-q6f6

openwrt/luci
------------

GHSA-vx64-mmp7-h36c (luci-app-samba4 read exec). 2a58b5c6c236 (2026-06-28),
"luci-app-samba4: tighten read exec access". The ACL file is byte-identical on
master, openwrt-25.12, and openwrt-24.10. The remaining read exec entry is
"/usr/sbin/smbd -V".
https://github.com/openwrt/luci/security/advisories/GHSA-vx64-mmp7-h36c

GHSA-jf59-v86x-fwf2 (luci-app-lxc). fdc8eb01d0ee (2026-05-12),
"luci-app-lxc: fix
authenticated path traversal and ACL bypass (host root)".
applications/luci-app-lxc/ucode/controller/lxc.uc is the same blob on master and
openwrt-25.12. openwrt-24.10 still has the package, without that ucode
controller; I
did not confirm an equivalent fix there.
https://github.com/openwrt/luci/security/advisories/GHSA-jf59-v86x-fwf2

GHSA-jjcx-c284-2qv8 (luci-app-openvpn path traversal). openwrt-25.12
e9ebca7598ce and
openwrt-24.10 739d307be35a (both 2026-05-10), "luci-app-openvpn:
security fix", which
names this path traversal. Master no longer ships the Lua app (removed Feb 2026,
f0b11adf7ef6).
https://github.com/openwrt/luci/security/advisories/GHSA-jjcx-c284-2qv8

GHSA-xwc5-mx58-rh35 (luci-app-tailscale-community do_login). 507ab5e45c30
(2026-06-11), "luci-app-tailscale-community: fix shell code injections
through login
params". shell_quote is present in that file on master and
openwrt-25.12. The app is
not on openwrt-24.10.
https://github.com/openwrt/luci/security/advisories/GHSA-xwc5-mx58-rh35

GHSA-vj96-f37g-37f6 (CVE-2026-55897, luci-app-advanced-reboot). The
advisory still
says "none known as of 2026-06-15". f85102548ee8 (2026-06-15) updates the app to
1.1.2-6. On master, openwrt-25.12, and openwrt-24.10 the read ACL no
longer grants
file.exec of /bin/sh.
https://github.com/openwrt/luci/security/advisories/GHSA-vj96-f37g-37f6

GHSA-ggpf-xrph-wg5v (CVE-2026-55159, luci-app-adblock-fast crontab).
Current master
is luci-app-adblock-fast 1.2.4-4. syncCron writes the crontab from
bounded schedule
fields, and cron_write validates the line. 1.2.4-4 is already recorded
on the related
XSS advisory GHSA-q335-4c83-c88h. This one still has an empty patched
version. Worth a
confirmation from the app maintainer, then the same version.
https://github.com/openwrt/luci/security/advisories/GHSA-ggpf-xrph-wg5v

GHSA-686p-p8p9-x6fh (DHCPv6 lease hostname in LuCI tables). LuCI side of
GHSA-hhmc-92hw-535f. See that entry. Status tables use %h on all three
LuCI branches.
The network DHCP lease table uses %h on master and openwrt-25.12.
https://github.com/openwrt/luci/security/advisories/GHSA-686p-p8p9-x6fh

Fix is on master; stable branches still need a look
====================================================

GHSA-v5f9-62c7-cw29 (luci-mod-system mounts ACL). 903af348552f (2026-07-20),
"luci-mod-system: cleanup mount ACL group". On master,
/etc/crontabs/root is only in
luci-mod-system-cron. On openwrt-25.12 and openwrt-24.10 the mounts
group still has
write access to /etc/crontabs/root.
https://github.com/openwrt/luci/security/advisories/GHSA-v5f9-62c7-cw29

GHSA-cq4h-h8jr-3xqv (luci-app-dockerman ttyd_start). ed11e49cf3ed (2026-07-20),
"luci-app-dockerman: fix OS command injection via ttyd_start". The
commit message
names this GHSA. openwrt-25.12 still has "docker.*": ["*"] on the read ACL, and
ttyd_start in the rpc file. The openwrt-24.10 ACL grants UCI only.
https://github.com/openwrt/luci/security/advisories/GHSA-cq4h-h8jr-3xqv

GHSA-pm9w-522m-8rrh (luci-proto-openvpn cl_meta). e4ff45ecbc6a (2026-06-28),
"luci-proto-openvpn: fix shell code injection through gerateKey arg". cl_meta is
passed through shellquote() on master. That ucode file is not on
openwrt-25.12 or
openwrt-24.10.
https://github.com/openwrt/luci/security/advisories/GHSA-pm9w-522m-8rrh

GHSA-jgc3-4q3p-g6xh (luci-lib-px5g). cbf6d42c3370 (2026-08-08),
"luci-lib-px5g: drop
package". The package is gone on master and still built on openwrt-25.12 and
openwrt-24.10. I did not find an in-place fix on those branches.
https://github.com/openwrt/luci/security/advisories/GHSA-jgc3-4q3p-g6xh

GHSA-vrj9-6xwg-6cf9 (luci-proto-openvpn read ACL and generateKey).
Still says "none
known as of 2026-06-15". The cl_meta injection fix above is later
(e4ff45ecbc6a). The
read ACL on master still grants luci.openvpn "*".
https://github.com/openwrt/luci/security/advisories/GHSA-vrj9-6xwg-6cf9

Partial
=======

GHSA-8v49-6387-7f89 (luci-app-upnp description). 08ce6fe64372 (2026-06-28),
"luci-app-upnp: escape description field in output". The status
include and one table
use %h. A second table in
applications/luci-app-upnp/htdocs/luci-static/resources/view/upnp/upnp.js
still passes
rule.descr through as a raw string on master and openwrt-25.12.
openwrt-24.10 escapes
both tables in that file.
https://github.com/openwrt/luci/security/advisories/GHSA-8v49-6387-7f89

No fix commit found
===================

GHSA-c6vf-395q-4jv6 (luci-app-https-dns-proxy). The 25.12.6
announcement lists this
as fixed. The latest change to overview.js is d90ee37daae4
(2026-07-17), "update to
2026.05.06-1". That file still appends a regex capture from resolver_url to the
provider label. I could not find a commit that names this advisory.
https://github.com/openwrt/luci/security/advisories/GHSA-c6vf-395q-4jv6

GHSA-r6hx-4f83-vp8m (luci-app-banip log monitor). banip 1.9.1-2 on
packages master and
openwrt-25.12 selects the address with pick_ip(), using a per-term anchor from
ban_logterm_map and defaulting to the last address. I did not find a commit that
names this advisory. openwrt-24.10 is still banip 1.5.6-7.
https://github.com/openwrt/luci/security/advisories/GHSA-r6hx-4f83-vp8m

GHSA-p35r-3323-6g7g (luci-app-travelmate). No commit found that addresses the
auto-login command. The advisory still says "none known".
https://github.com/openwrt/luci/security/advisories/GHSA-p35r-3323-6g7g

On Wed, Oct 28, 2026 at 5:41 PM Hauke Mehrtens <hauke at hauke-m.de> wrote:
>
> On 9/29/26 01:28, Hauke Mehrtens wrote:
> > Hi,
> >
> > I am planning to tag 25.12.6 and 24.10.9 soon.
> >
> > I plan to update the Linux kernel and mac80211 on 25.12 branch before
> > tagging. Tagging of 25.12.6 will probably happen in about 2 weeks.
> >
> > 24.10.9 will probably get tagged 2 weeks alter. 24.10.9 will be the
> > final release. 24.10.9 might not contain all security fixes we have in
> > the 25.12 branch. I consider it EoL already now.
> >
> > If you want an special changes in please create a PR for the release.
> >
> > PRs for 25.12
> > https://github.com/openwrt/openwrt/pulls?
> > q=is%3Apr+state%3Aopen+sort%3Aupdated-desc+label%3Arelease%2F25.12
> >
> > Prs for 24.10:
> > https://github.com/openwrt/openwrt/pulls?
> > q=is%3Apr+state%3Aopen+sort%3Aupdated-desc+label%3Arelease%2F24.10
> >
> > There are many security advisors pending in draft mode:
> > https://github.com/openwrt/openwrt/security/advisories
> > If you have access please help fixing them. Just create a PR or merge
> > the fix.
> >
> > Does someone want to take over this PR:
> > https://github.com/openwrt/luci/pull/8878
> >
> > Hauke
> Hi,
>
> I am planning to tag 24.10.9 in the next days. I think I merged all PRs
> which should go into this release. This still misses many security
> fixes, but that should be fine. 24.10 is EoL already.
>
> I am planning to do a 25.12.7 some weeks after to get some more security
> updates released.
>
> Hauke
>
> _______________________________________________
> openwrt-devel mailing list
> openwrt-devel at lists.openwrt.org
> https://lists.openwrt.org/mailman/listinfo/openwrt-devel