PT-2026-27228 · Openclaw · Openclaw

Migraine + 1 · Published 2026-03-23 · Updated 2026-03-23 · CVE-2026-32066

NVD

CVSS v3.1

7.5

High

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

OpenClaw before 2026.3.1 contains an unbounded memory growth vulnerability in the Zalo webhook endpoint that allows unauthenticated attackers to trigger memory exhaustion by varying query strings. Attackers can send repeated requests with different query parameters to the same webhook route, causing unbounded in-memory key accumulation that leads to memory pressure, process instability, or out-of-memory conditions.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-32066

Affected Products

Openclaw

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-32066 · Security Note
• https://github.com/openclaw/openclaw/security/advisories/GHSA-wr6m-jg37-68xh · Note
• https://vulncheck.com/advisories/openclaw-mar-unbounded-memory-growth-via-zalo-webhook-query-string · Note