Multiple memory leaks in openNDS before 11.0.0 allow an unauthenticated attacker on the captive portal network to exhaust all available memory on… (CVE-2026-38819)

CVE-2026-38819 describes multiple memory leak vulnerabilities in openNDS prior to version 11.0.0. An unauthenticated attacker with access to the captive portal network can exploit these leaks to rapidly consume all available memory on the affected device, leading to a denial of service condition. The vulnerability is classified under CWE-401 (Improper Release of Memory). No known exploits are reported in the wild. There is no explicit patch or remediation information provided in the source data.

Successful exploitation results in exhaustion of device memory, causing denial of service. There is no impact on confidentiality or integrity according to the CVSS vector. The attack requires network access to the captive portal and has high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the captive portal network to trusted users and monitor device memory usage to detect potential exploitation attempts.