Executive brief
OpenClaw is a popular open-source communications platform used to manage inbound media and channel ingestion. A flaw allows remote attackers to send oversized media files that bypass configured size limits, causing the application to buffer excessive data in memory. This can trigger denial of service through process instability and memory exhaustion before the oversized content is rejected.
Technical details
OpenClaw failed to consistently enforce configured inbound media byte limits before buffering remote media across multiple channel ingestion paths (CWE-400, CWE-770). A remote, unauthenticated sender can exploit this by transmitting oversized media payloads that exceed configured limits but are buffered into memory before validation rejects them. The vulnerability affects versions ≤2026.2.21-2 and has been fixed in version 2026.2.22. An attacker can trigger elevated memory consumption and potential process instability, leading to denial of service.
Affected products
- OpenClaw openclaw ≤2026.2.21-2
Timeline
- 2026-03-02: disclosed: Advisory published
- 2026-02-23: patched: Patch version 2026.2.22 planned