PT-2026-31768 · Openclaw · Openclaw

Edward-X · Published 2026-03-26 · Updated 2026-04-10 · CVE-2026-35633

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.22

Description OpenClaw is susceptible to an unbounded memory allocation issue in its remote media HTTP error handling. Attackers can exploit this by sending specially crafted HTTP error responses with large content to remote media endpoints. This causes the application to allocate an excessive amount of memory before error handling can take place, potentially leading to application failure.

Recommendations Update to version 2026.3.22 or later.

Fix

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-789

CWE-400

CWE-770

Related Identifiers

CVE-2026-35633

GHSA-4QWC-C7G9-4XCW

GHSA-HM63-VWJ4-MJ2Q

Affected Products

Openclaw

References · 11

• https://github.com/openclaw/openclaw/security/advisories/GHSA-4qwc-c7g9-4xcw · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/81445a901091a5d27ef0b56fceedbe4724566438 · Patch
• https://github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171dac87 · Patch
• https://osv.dev/vulnerability/GHSA-4qwc-c7g9-4xcw · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hm63-vwj4-mj2q · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35633 · Security Note
• https://github.com/openclaw/openclaw · Note
• https://twitter.com/infoflowcloud/status/2042389975568732298 · Twitter Post
• https://vulncheck.com/advisories/openclaw-unbounded-memory-allocation-via-remote-media-error-responses · Note
• https://twitter.com/CVEnew/status/2042387947920728358 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2042469610780229916 · Twitter Post