LoginSign Up
← Back to all sparks
O

OpenWrt

DEVOPS
Velocity2.5

Linux operating system for embedded network devices

openwrt.org ↗

OpenWrt's releases are still set by security fixes, now mostly on the 25.12 branch.

router-firmwareembedded-linuxcve-responsedevice-supportsecurity-audit
◆Current state
OpenWrt 25.12 is the active stable series, and its sixth service release on October 19 fixed several remotely triggerable flaws in network services that are enabled by default. Nearly every release since March has been vulnerability response, from the Trail of Bits audit CVEs to odhcpd's DHCPv6 overflow and the dnsmasq backports. The 24.10 branch's last entry is 24.10.8 in July.
◆Where it's heading
Releases are driven by disclosures in default services such as odhcpd and dnsmasq, with device support added on the side. 24.10 appears to be winding down, which leaves 25.12 as the only line getting fixes.
◆Prediction
Expect a 25.12.7 when the next default-service CVE batch lands; whether 24.10 gets any further release is unclear from the feed.

◆Recent moves

  1. 21d ago

    OpenWrt 25.12.6 fixes remote flaws in default services

    The sixth 25.12 service release fixes several remotely triggerable vulnerabilities in default-enabled network services, including uhttpd. Updating is strongly recommended.

    View source ↗
  2. 3mo ago

    Remotely triggerable odhcpd flaws patched on 24.10

    A security release for the 24.10 maintenance branch covering multiple remotely triggerable flaws in network services enabled by default, chiefly odhcpd. The notes repeat the September 2026 EoL warning and push users toward 25.12.

    View source ↗
  3. 4mo ago

    Critical DHCPv6 overflow in odhcpd patched

    The 25.12 counterpart carrying the same odhcpd fixes, including a critical stack buffer overflow in DHCPv6 IA reply serialization reachable with crafted REQUEST packets, plus a use-after-free and a memory disclosure. Both branches were patched within weeks of each other, as is now standard for this project.

    View source ↗
  4. 5mo ago

    dnsmasq fixes and the Dirty Frag IPsec privilege escalation

    Security maintenance for 24.10 covering dnsmasq and a kernel update to 6.6.138 that closes an IPsec ESP local privilege escalation. Only devices with the IPsec kernel modules loaded are affected, which the notes are careful to scope.

    View source ↗
  5. 5mo ago

    Six dnsmasq CVEs backported plus the kernel IPsec fix

    Backports six upstream dnsmasq CVE patches — heap overflow in domain-name handling, two DNSSEC crash paths, a DHCPv6 CLID overflow and broken EDNS Client Subnet validation — alongside the same kernel IPsec fix. DNS and DHCP remain where most of the exposure sits in this firmware.

    View source ↗
  6. 6mo ago

    TLS library updates and seven new device targets

    Updates mbedtls, OpenSSL and wolfSSL for multiple CVEs and closes a kernel issue affecting a narrow set of targets, while adding support for seven new devices across mediatek and ramips. A representative service release — TLS library churn plus steady hardware accretion.

    View source ↗