PT-2026-25134 · Npm · Openclaw

Published 2026-03-02 · Updated 2026-03-02

OSV

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Summary

Unauthenticated requests to a reachable Zalo webhook endpoint could trigger unbounded in-memory key growth by varying query strings on the same valid webhook route.

Impact

An attacker could cause memory pressure and potential process instability or OOM, degrading availability.

Fix

Webhook security tracking now normalizes keys to matched webhook path semantics (query excluded) and bounds/prunes tracking state to prevent unbounded growth.

Affected and Patched Versions

• Affected: <= 2026.2.26
• Patched: 2026.3.1

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

GHSA-WR6M-JG37-68XH

Affected Products

Openclaw

References · 3

• https://osv.dev/vulnerability/GHSA-wr6m-jg37-68xh · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/security/advisories/GHSA-wr6m-jg37-68xh · Note