PT-2026-23530 · Openclaw+1 · Openclaw+1

Vincent Koc · Published 2026-02-18 · Updated 2026-03-07 · CVE-2026-28452

Positive Technologies (AI Summary)

CVSS v4.0

6.7

Medium

Base vector

AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.14 clawdbot versions prior to 2026.1.24-3

Description The software contains a denial of service issue in the extractArchive function within src/infra/archive.ts. Attackers can provide maliciously crafted ZIP and TAR archives during install or update operations to consume excessive CPU, memory, and disk resources. This can lead to service degradation or system unavailability. The issue stems from a lack of strict resource budgets during archive extraction.

Recommendations OpenClaw versions prior to 2026.2.14 should be updated to version 2026.2.14 or later. clawdbot versions prior to 2026.1.24-3 should be updated to version 2026.1.24-3 or later.

Fix

DoS

Allocation of Resources Without Limits

Resource Exhaustion

Weakness Enumeration

CWE-770

CWE-400

Related Identifiers

CVE-2026-28452

GHSA-H89V-J3X9-8WQJ

Affected Products

Openclaw

Clawdbot

References · 10

• https://github.com/openclaw/openclaw/commit/d3ee5deb87ee2ad0ab83c92c365611165423cb71 · Patch
• https://github.com/openclaw/openclaw/commit/5f4b29145c236d124524c2c9af0f8acd048fbdea · Patch
• https://osv.dev/vulnerability/GHSA-h89v-j3x9-8wqj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-28452 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28452 · Security Note
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/security/advisories/GHSA-h89v-j3x9-8wqj · Vendor Advisory, Patch
• https://github.com/openclaw/openclaw/releases/tag/v2026.2.14 · Note
• https://vulncheck.com/advisories/openclaw-denial-of-service-via-unguarded-archive-extraction-in-extractarchive · Note
• https://twitter.com/CVEnew/status/2030385191747760307 · Twitter Post