PT-2026-26393 · Google+2 · Google Chat+2

Baozongwixd · Published 2026-03-03 · Updated 2026-04-10 · CVE-2026-32011

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.2

Description OpenClaw contains a denial of service issue in webhook handlers for BlueBubbles and Google Chat. These handlers parse request bodies before authentication and signature validation. Unauthenticated attackers can exploit this by sending slow or oversized request bodies to exhaust parser resources and degrade service availability. The affected packages are openclaw (npm) with vulnerable releases less than or equal to 2026.3.1.

Recommendations Upgrade to version 2026.3.2 or newer. The fix enforces authentication before body processing for affected webhook paths, adds strict pre-authentication body and time limits, and introduces shared in-flight request guardrails with regression coverage.

Fix

DoS

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

Related Identifiers

CVE-2026-32011

GHSA-X4VP-4235-65HG

Affected Products

Bluebubbles

Google Chat

Openclaw

References · 11

• https://github.com/openclaw/openclaw/commit/d3e8b17aa6432536806b4853edc7939d891d0f25 · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-x4vp-4235-65hg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-32011 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32011 · Security Note
• https://osv.dev/vulnerability/GHSA-x4vp-4235-65hg · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://vulncheck.com/advisories/openclaw-slow-request-denial-of-service-via-pre-auth-webhook-body-parsing · Note
• https://twitter.com/RedPacketSec/status/2034870890555470112 · Twitter Post
• https://twitter.com/CVEnew/status/2034891604121489624 · Twitter Post
• https://twitter.com/dailycve/status/2038964808884642081 · Twitter Post
• https://twitter.com/CVEnew/status/2042710246028632080 · Twitter Post