PT-2026-23523 · Openclaw · Openclaw

Vincent Koc · CVE-2026-28394 · Published 2026-02-19 · Updated 2026-03-10

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.15

Description The web fetch tool within OpenClaw can cause a denial of service by crashing the Gateway process due to memory exhaustion. This occurs when parsing oversized or deeply nested HTML responses fetched from attacker-controlled URLs. An attacker can potentially social-engineer a user or automated system into fetching a malicious URL, leading to server memory exhaustion and service unavailability.

Recommendations Update to OpenClaw version 2026.2.15 or later.

Exploit

Fix

DoS

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

Related Identifiers

CVE-2026-28394

GHSA-P536-VVPP-9MC8

Affected Products

Openclaw

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28394.json · Exploit
• https://github.com/openclaw/openclaw/security/advisories/GHSA-p536-vvpp-9mc8 · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/166cf6a3e04c7df42bea70a7ad5ce2b9df46d147 · Patch
• https://osv.dev/vulnerability/CVE-2026-28394 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p536-vvpp-9mc8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28394 · Security Note
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/releases/tag/v2026.2.15 · Note
• https://t.me/cveNotify/154430 · Telegram Post
• https://twitter.com/CVEnew/status/2030385198374736254 · Twitter Post
• https://vulncheck.com/advisories/openclaw-denial-of-service-via-unbounded-response-parsing-in-web-fetch-tool · Note
• https://twitter.com/dailycve/status/2031214531679080509 · Twitter Post
• https://twitter.com/renandnzsantos/status/2030385569650380904 · Twitter Post