OpenClaw before 2026.3.22 contains an unbounded memory allocation vulnerability in remote media HTTP error handling that allows attackers to trigger excessive memory consumption. Attackers can send crafted HTTP error responses with large bodies to remote media endpoints, causing the application to allocate unbounded memory before failure handling occurs.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
None
No data modification
Availability
Low
Partial disruption
CVSS Vector v4.0
Weakness Type (CWE)
References 4
https://github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171…
disclosure@vulncheck.com
https://github.com/openclaw/openclaw/commit/81445a901091a5d27ef0b56fceedbe47245…
disclosure@vulncheck.com
https://github.com/openclaw/openclaw/security/advisories/GHSA-4qwc-c7g9-4xcw
disclosure@vulncheck.com
https://www.vulncheck.com/advisories/openclaw-unbounded-memory-allocation-via-r…
disclosure@vulncheck.com