Is CVE-2026-32062 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-32062 being exploited in the wild.

How severe is CVE-2026-32062?

High severity, with a CVSS score of 7.5, published 11 March 2026.

Which products and versions are affected?

@openclaw/voice-call (npm) < 2026.2.22, SEMVER:introduced=0,fixed=2026.2.22; Openclaw <= 2026.2.21-2, 2026.2.21-2 up to (but not including) 2026.2.22; Openclaw Voice-Call <= 2026.2.21, 2026.2.21 up to (but not including) 2026.2.22.

Is there a fix for CVE-2026-32062?

Yes. @openclaw/voice-call (npm): upgrade to 2026.2.22 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-32062 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-32062?

Check whether you run @openclaw/voice-call (npm), Openclaw or Openclaw Voice-Call at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-32062: OpenClaw resource exhaustion in voice-call media-stream WebSocket upgrade

Q: Is there a fix for CVE-2026-32062?

Yes. @openclaw/voice-call (npm): upgrade to 2026.2.22 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-32062 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-32062?

Check whether you run @openclaw/voice-call (npm), Openclaw or Openclaw Voice-Call at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-32062 · Severity: high · CVSS 7.5 · Published 2026-03-11

OpenClaw, a platform for voice communication, contains a flaw in how it handles incoming media stream connections. An attacker can open numerous connections without providing valid credentials, potentially overwhelming the system's resources. This can lead to a service outage or significant performance degradation for legitimate users trying to make voice calls.

Technologies: Openclaw, Openclaw Voice-Call. Vendors: npm, Openclaw.

Quick answers

Is CVE-2026-32062 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-32062 being exploited in the wild.
How severe is CVE-2026-32062?: High severity, with a CVSS score of 7.5, published 11 March 2026.
Which products and versions are affected?: @openclaw/voice-call (npm) < 2026.2.22, SEMVER:introduced=0,fixed=2026.2.22; Openclaw <= 2026.2.21-2, 2026.2.21-2 up to (but not including) 2026.2.22; Openclaw Voice-Call <= 2026.2.21, 2026.2.21 up to (but not including) 2026.2.22.
Is there a fix for CVE-2026-32062?: Yes. @openclaw/voice-call (npm): upgrade to 2026.2.22 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-32062 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-32062?: Check whether you run @openclaw/voice-call (npm), Openclaw or Openclaw Voice-Call at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@openclaw/voice-call (npm): upgrade to 2026.2.22 or later
```
npm install @openclaw/voice-call@2026.2.22
```

Technical details

A resource exhaustion vulnerability exists in the @openclaw/voice-call package due to improper WebSocket connection handling. The media-stream path performs a WebSocket upgrade before validating the stream via the shouldAcceptStream() function, which is only triggered after a 'start' frame is received. This allows unauthenticated remote attackers to maintain idle, unvalidated sockets, consuming connection-related resources. If exploited at scale, this leads to a denial-of-service (DoS) condition for legitimate media streams. The fix introduces strict pre-start timeouts and connection caps per IP and globally.

Affected products

OpenClaw openclaw <= 2026.2.21-2
OpenClaw @openclaw/voice-call <= 2026.2.21

Identifiers

CVE-2026-32062
GHSA-mfg5-7q5g-f37j

Timeline

2026-02-23: disclosed: Initial disclosure to vendor
2026-03-02: advisory: GitHub Advisory published
2026-03-11: other: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.