# CVE-2026-28478: OpenClaw denial of service via unbounded webhook request body buffering

Source: https://junglewise.ai/threats/cve-2026-28478-openclaw-denial-of-service-via-unbounded-webhook-request-body  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-18. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-28478 · Severity: low · CVSS 3.1 · Published 2026-02-18

OpenClaw is an AI agent platform that handles integrations with multiple messaging and collaboration services. Multiple webhook handlers in the system accepted and buffered incoming request bodies without enforcing size or time limits, allowing remote attackers to send oversized payloads that consume server memory and degrade service availability for all users.

Technologies: [clawdbot (npm)](https://junglewise.ai/threats/technologies/clawdbot), [Openclaw](https://junglewise.ai/threats/technologies/openclaw). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Openclaw](https://junglewise.ai/threats/vendors/openclaw).

## Quick answers

**Is CVE-2026-28478 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-28478 being exploited in the wild.

**How severe is CVE-2026-28478?** Low severity, with a CVSS score of 3.1, published 18 February 2026.

**Which products and versions are affected?** clawdbot (npm) SEMVER:introduced=0,last_affected=2026.1.24-3; Openclaw <2026.2.13.

**Is there a fix for CVE-2026-28478?** A patch was published on 2026-02-18: Fix available in OpenClaw >=2026.2.13 and clawdbot >2026.1.24-3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-28478 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-28478?** Check whether you run clawdbot (npm) or Openclaw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is an uncontrolled resource consumption issue (CWE-400) in webhook request handling. Multiple webhook code paths buffered HTTP request bodies without consistent maxBytes and timeoutMs enforcement; some SDK-backed handlers parsed request bodies internally without stream-level guards. A remote, unauthenticated attacker can exploit this by sending large JSON payloads or slow/incomplete uploads to webhook endpoints (e.g., LINE, Slack, Telegram, Nextcloud Talk, Google Chat, and others), causing elevated memory usage and request handler pressure that degrades availability. The fix introduced a shared bounded request-body helper in src/infra/http-body.ts with standardized responses (413 Payload Too Large, 408 Request Timeout) and applied it consistently across all affected webhook paths.

## Affected products

- OpenClaw OpenClaw <2026.2.13
- OpenClaw clawdbot <=2026.1.24-3

## Identifiers

- CVE-2026-28478
- GHSA-q447-rj3r-2cgh

## Timeline

- 2026-02-18: disclosed: Advisory GHSA-q447-rj3r-2cgh published
- 2026-02-18: patched: Fix available in OpenClaw >=2026.2.13 and clawdbot >2026.1.24-3

## References

- [https://github.com/openclaw/openclaw/security/advisories/GHSA-q447-rj3r-2cgh](https://github.com/openclaw/openclaw/security/advisories/GHSA-q447-rj3r-2cgh)
- [https://github.com/openclaw/openclaw](https://github.com/openclaw/openclaw)

## Related threats

- [OpenClaw incorrect authorization in mcp.app.view method](https://junglewise.ai/threats/cve-2026-102807-openclaw-before-2026-9-4-contains-an-incorrect-authorization)
- [OpenClaw incorrect authorization in Gateway media root allowlist](https://junglewise.ai/threats/cve-2026-102806-openclaw-before-2026-9-5-contains-an-incorrect-authorization)
- [OpenClaw exec approval bypass in Google Meet node commands](https://junglewise.ai/threats/cve-2026-100599-openclaw-versions-2026-5-1-through-2026-7-0-fail-to-apply-the)
- [OpenClaw Signal approval reaction binding logic error](https://junglewise.ai/threats/cve-2026-100598-openclaw-npm-package-openclaw-before-2026-7-1-incorrectly-binds)
- [OpenClaw time-of-check time-of-use race condition in filesystem operations](https://junglewise.ai/threats/cve-2026-100597-openclaw-npm-package-openclaw-before-2026-7-1-is-vulnerable-to-a)