PT-2026-27228 · Openclaw · Openclaw

Migraine + 1 · Publicado 2026-03-02 · Atualizado 2026-03-24 · CVE-2026-32066

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.1

Description The software contains a memory growth issue in the Zalo webhook endpoint. Unauthenticated attackers can cause memory exhaustion by sending repeated requests with different query strings to the same webhook route. This leads to unbounded in-memory key accumulation, resulting in memory pressure and potential process instability. The API endpoint affected is the Zalo webhook endpoint. The vulnerability is triggered by varying query strings (query strings) sent to the endpoint.

Recommendations Update to version 2026.3.1 or later.

Correção

Allocation of Resources Without Limits

Resource Exhaustion

Enumeração de Fraquezas

CWE-770

CWE-400

Identificadores relacionados

CVE-2026-32066

GHSA-WR6M-JG37-68XH

Produtos afetados

Openclaw

Referências · 6

• https://github.com/openclaw/openclaw · Nota
• https://github.com/openclaw/openclaw/security/advisories/GHSA-wr6m-jg37-68xh · Nota
• https://osv.dev/vulnerability/GHSA-wr6m-jg37-68xh · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-32066 · Nota de Segurança
• https://vulncheck.com/advisories/openclaw-mar-unbounded-memory-growth-via-zalo-webhook-query-string · Nota
• https://twitter.com/VulmonFeeds/status/2036313966201143389 · Publicação no Twitter