PT-2026-23565 · Openclaw+1 · Openclaw+1

Vincent Koc · Published 2026-02-14 · Updated 2026-03-11 · CVE-2026-29612

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.14 clawdbot versions prior to 2026.1.24-3

Description The software decodes base64-backed media inputs into buffers before enforcing decoded-size budget limits. Attackers can supply oversized base64 payloads, leading to large memory allocations and potentially causing memory pressure and denial of service. Deployments binding the gateway to loopback with gateway authentication for HTTP endpoints are considered a local/authorized denial of service risk. Exposure to untrusted networks without adequate authentication and rate limits elevates the risk to a network denial of service.

Recommendations Update OpenClaw to version 2026.2.14 or later. Migrate from clawdbot to OpenClaw.

Fix

DoS

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

Related Identifiers

BDU:2026-06162

CVE-2026-29612

GHSA-W2CG-VXX6-5XJG

Affected Products

Openclaw

Clawdbot

References · 12

• https://github.com/openclaw/openclaw/commit/31791233d60495725fa012745dde8d6ee69e9595 · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-w2cg-vxx6-5xjg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-29612 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-29612 · Security Note
• https://osv.dev/vulnerability/GHSA-w2cg-vxx6-5xjg · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-06162 · Security Note
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/releases/tag/v2026.2.14 · Note
• https://t.me/cveNotify/155013 · Telegram Post
• https://t.me/CVEtracker/46509 · Telegram Post
• https://vulncheck.com/advisories/openclaw-denial-of-service-via-large-base-media-file-decoding · Note
• https://twitter.com/MikuKawai_desu/status/2030793338182586587 · Twitter Post