PT-2026-26731 · Openclaw · Openclaw

Tdjackey · Published 2026-03-02 · Updated 2026-03-21 · CVE-2026-32049

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.22

Description The software does not consistently enforce configured inbound media byte limits before buffering remote media across multiple channel ingestion paths. This can allow remote attackers to send oversized media payloads, potentially leading to elevated memory usage and process instability.

Recommendations Update OpenClaw to version 2026.2.22 or later.

Fix

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

Related Identifiers

CVE-2026-32049

GHSA-RXXP-482V-7MRH

GHSA-XQ3G-M3J8-2VMM

Affected Products

Openclaw

References · 11

• https://github.com/openclaw/openclaw/security/advisories/GHSA-rxxp-482v-7mrh · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/73d93dee64127a26f1acd09d0403b794cdeb4f5c · Patch
• https://osv.dev/vulnerability/CVE-2026-32049 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32049 · Security Note
• https://osv.dev/vulnerability/GHSA-xq3g-m3j8-2vmm · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rxxp-482v-7mrh · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://vulncheck.com/advisories/openclaw-denial-of-service-via-inbound-media-download-byte-limit-bypass · Note
• https://twitter.com/RedPacketSec/status/2035308078136959446 · Twitter Post
• https://twitter.com/AgenticYield/status/2035503674986750278 · Twitter Post
• https://twitter.com/CVEnew/status/2035262086951915727 · Twitter Post