OpenWrt 25.12.6 Released with Security Fixes

The OpenWrt community has announced the sixth service release of the OpenWrt 25.12 stable series. This release includes several security fixes for vulnerabilities in core network services, including uhttpd, Mbed TLS, and hostapd/wpa_supplicant. The updates address issues such as memory-exhaustion denial of service, out-of-bounds write, and unlimited memory growth. Users are strongly recommended to update to this new version.

What's Changed in OpenWrt 25.12.6

• uhttpd Update: uhttpd was updated to fix five published advisories, including memory-exhaustion denial of service and out-of-bounds write.
• Mbed TLS Update: Mbed TLS was updated to version 3.6.7, fixing multiple security vulnerabilities, including a remote buffer overflow in (D)TLS with ECDHE-PSK cipher suites.
• hostapd/wpa_supplicant Update: hostapd/wpa_supplicant was updated to fix issues with missing validation when parsing multi-link information and NULL pointer dereference in APuP beacon handling.

Why it matters

The release of OpenWrt 25.12.6 is significant for users of OpenWrt, as it addresses several security vulnerabilities that could be exploited by attackers. By updating to this new version, users can ensure the security and stability of their networks. This release also highlights the importance of regular security updates and the need for users to stay informed about potential vulnerabilities in their systems.