PT-2026-26393 · Openclaw+2 · Openclaw+2
Baozongwixd
·
Publicado
2026-03-03
·
Atualizado
2026-04-10
·
CVE-2026-32011
CVSS v3.1
7.5
Alta
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
OpenClaw versions prior to 2026.3.2
Description
OpenClaw contains a denial of service issue in webhook handlers for BlueBubbles and Google Chat. These handlers parse request bodies before authentication and signature validation. Unauthenticated attackers can exploit this by sending slow or oversized request bodies to exhaust parser resources and degrade service availability. The affected packages are
openclaw (npm) with vulnerable releases less than or equal to 2026.3.1.Recommendations
Upgrade to version 2026.3.2 or newer. The fix enforces authentication before body processing for affected webhook paths, adds strict pre-authentication body and time limits, and introduces shared in-flight request guardrails with regression coverage.
Correção
DoS
Allocation of Resources Without Limits
Resource Exhaustion
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Bluebubbles
Google Chat
Openclaw