PT-2026-27228 · Openclaw · Openclaw

Migraine + 1 · Published 2026-03-02 · Updated 2026-03-24 · CVE-2026-32066

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.1

Description The software contains a memory growth issue in the Zalo webhook endpoint. Unauthenticated attackers can cause memory exhaustion by sending repeated requests with different query strings to the same webhook route. This leads to unbounded in-memory key accumulation, resulting in memory pressure and potential process instability. The API endpoint affected is the Zalo webhook endpoint. The vulnerability is triggered by varying query strings (query strings) sent to the endpoint.

Recommendations Update to version 2026.3.1 or later.

Fix

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

Related Identifiers

CVE-2026-32066

GHSA-WR6M-JG37-68XH

Affected Products

Openclaw

References · 6

• https://osv.dev/vulnerability/GHSA-wr6m-jg37-68xh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32066 · Security Note
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/security/advisories/GHSA-wr6m-jg37-68xh · Note
• https://twitter.com/VulmonFeeds/status/2036313966201143389 · Twitter Post
• https://vulncheck.com/advisories/openclaw-mar-unbounded-memory-growth-via-zalo-webhook-query-string · Note