PT-2026-31775 · Openclaw · Openclaw

Tdjackey · Published 2026-03-29 · Updated 2026-04-10 · CVE-2026-35640

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.25

Description OpenClaw versions prior to 2026.3.25 are susceptible to a denial of service. The software parses JSON request bodies before validating webhook signatures, which allows unauthenticated attackers to trigger resource-intensive parsing operations. Attackers can send malicious webhook requests to exhaust server resources by forcing JSON parsing before signature rejection.

Recommendations Update to version 2026.3.25 or later.

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-696

CWE-400

Related Identifiers

CVE-2026-35640

GHSA-3H52-CX59-C456

GHSA-8F9R-GR6R-X63Q

Affected Products

Openclaw

References · 10

• https://github.com/openclaw/openclaw/security/advisories/GHSA-3h52-cx59-c456 · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/5e8cb22176e9235e224be0bc530699261eb60e53 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-35640 · Security Note
• https://osv.dev/vulnerability/GHSA-8f9r-gr6r-x63q · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3h52-cx59-c456 · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://twitter.com/CVEnew/status/2042364316259651727 · Twitter Post
• https://vulncheck.com/advisories/openclaw-denial-of-service-via-unauthenticated-webhook-request-parsing · Note
• https://twitter.com/infoflowcloud/status/2042366146054168814 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2042456811970719974 · Twitter Post