# CVE-2026-101881: OpenClaw Windows Node memory exhaustion in WebSocket transport

Source: https://junglewise.ai/threats/cve-2026-101881-openclaw-windows-node-before-2026-7-1-contains-an-allocation-of  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-30. Updated: 2026-09-30  
License: CC BY 4.0 with a link back

CVE-2026-101881 · Severity: medium · CVSS 6.5 · Published 2026-09-30

OpenClaw Windows Node is a distributed computing component that uses WebSocket connections to communicate with gateway nodes. A memory exhaustion vulnerability allows connected gateways to crash the node by sending malformed WebSocket messages that accumulate unbounded memory, resulting in a denial of service.

Technologies: [Openclaw Windows Node](https://junglewise.ai/threats/technologies/windows-node). Vendors: [Openclaw](https://junglewise.ai/threats/vendors/openclaw).

## Quick answers

**Is CVE-2026-101881 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-101881 being exploited in the wild.

**How severe is CVE-2026-101881?** Medium severity, with a CVSS score of 6.5, published 30 September 2026.

**Which products and versions are affected?** Openclaw Windows Node before 2026.7.1.

**Is there a fix for CVE-2026-101881?** A patch was published on 2026-07-20: Fix committed to main branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-101881 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-101881?** Check whether you run Openclaw Windows Node at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An allocation without limits vulnerability exists in the WebSocketClientBase component where multi-frame WebSocket text messages without EndOfMessage markers cause unbounded memory growth in an accumulating StringBuilder. Attackers with network access to connected gateways can send a continuous stream of WebSocket continuation frames to exhaust node memory and crash the process. The fix bounds accumulated inbound messages to 32M UTF-16 characters and closes connections that exceed the limit.

## Affected products

- OpenClaw Windows Node before 2026.7.1

## Timeline

- 2026-09-30: disclosed
- 2026-07-20: patched: Fix committed to main branch

## References

- [https://github.com/openclaw/openclaw-windows-node/blob/v0.6.12/src/OpenClaw.Shared/WebSocketClientBase.cs](https://github.com/openclaw/openclaw-windows-node/blob/v0.6.12/src/OpenClaw.Shared/WebSocketClientBase.cs)
- [https://github.com/openclaw/openclaw-windows-node/commit/1810e357aa0d0639099b347f31c746ba7d31512a](https://github.com/openclaw/openclaw-windows-node/commit/1810e357aa0d0639099b347f31c746ba7d31512a)

## Related threats

- [OpenClaw Windows Node environment-variable injection in system.run](https://junglewise.ai/threats/cve-2026-101884-openclaw-windows-node-before-2026-7-1-contains-an-incomplete)
- [OpenClaw Windows Node server-side request forgery in canvas.present](https://junglewise.ai/threats/cve-2026-101883-openclaw-windows-node-through-2026-9-4-contains-a-server-side)
- [OpenClaw Windows Node incomplete validation in exec approvals](https://junglewise.ai/threats/cve-2026-101882-openclaw-windows-node-before-2026-7-1-contains-an-incomplete)
- [OpenClaw Windows Node authorization bypass in exec-approval policy](https://junglewise.ai/threats/cve-2026-101880-openclaw-windows-node-before-2026-7-1-contains-an-incorrect)
- [OpenClaw Windows Node missing authorization in capture handlers](https://junglewise.ai/threats/cve-2026-101879-openclaw-windows-node-before-2026-7-1-3-contains-a-missing)