PT-2026-23523 · Openclaw · Openclaw

Vincent Koc · Published 2026-02-19 · Updated 2026-03-10 · CVE-2026-28394

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.15

Description The web fetch tool within OpenClaw can cause a denial of service by crashing the Gateway process due to memory exhaustion. This occurs when parsing oversized or deeply nested HTML responses fetched from attacker-controlled URLs. An attacker can potentially social-engineer a user or automated system into fetching a malicious URL, leading to server memory exhaustion and service unavailability.

Recommendations Update to OpenClaw version 2026.2.15 or later.

Fix

DoS

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

Related Identifiers

CVE-2026-28394

GHSA-P536-VVPP-9MC8

Affected Products

Openclaw

References · 12

• https://github.com/openclaw/openclaw/security/advisories/GHSA-p536-vvpp-9mc8 · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/166cf6a3e04c7df42bea70a7ad5ce2b9df46d147 · Patch
• https://osv.dev/vulnerability/GHSA-p536-vvpp-9mc8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28394 · Security Note
• https://osv.dev/vulnerability/CVE-2026-28394 · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/releases/tag/v2026.2.15 · Note
• https://t.me/cveNotify/154430 · Telegram Post
• https://twitter.com/CVEnew/status/2030385198374736254 · Twitter Post
• https://twitter.com/renandnzsantos/status/2030385569650380904 · Twitter Post
• https://twitter.com/dailycve/status/2031214531679080509 · Twitter Post
• https://vulncheck.com/advisories/openclaw-denial-of-service-via-unbounded-response-parsing-in-web-fetch-tool · Note