# CVE-2026-32062: OpenClaw resource exhaustion in voice-call media-stream WebSocket upgrade

Source: https://junglewise.ai/threats/cve-2026-32062-openclaw-resource-exhaustion-in-voice-call-media-stream-websocket  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-11. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2026-32062 · Severity: high · CVSS 7.5 · Published 2026-03-11

OpenClaw, a platform for voice communication, contains a flaw in how it handles incoming media stream connections. An attacker can open numerous connections without providing valid credentials, potentially overwhelming the system's resources. This can lead to a service outage or significant performance degradation for legitimate users trying to make voice calls.

Technologies: [Openclaw](https://junglewise.ai/threats/technologies/openclaw), [Openclaw Voice-Call](https://junglewise.ai/threats/technologies/voice-call). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Openclaw](https://junglewise.ai/threats/vendors/openclaw).

## Quick answers

**Is CVE-2026-32062 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-32062 being exploited in the wild.

**How severe is CVE-2026-32062?** High severity, with a CVSS score of 7.5, published 11 March 2026.

**Which products and versions are affected?** @openclaw/voice-call (npm) < 2026.2.22, SEMVER:introduced=0,fixed=2026.2.22; Openclaw <= 2026.2.21-2, 2026.2.21-2 up to (but not including) 2026.2.22; Openclaw Voice-Call <= 2026.2.21, 2026.2.21 up to (but not including) 2026.2.22.

**Is there a fix for CVE-2026-32062?** Yes. @openclaw/voice-call (npm): upgrade to 2026.2.22 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-32062 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-32062?** Check whether you run @openclaw/voice-call (npm), Openclaw or Openclaw Voice-Call at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @openclaw/voice-call (npm): upgrade to 2026.2.22 or later

  ```sh
  npm install @openclaw/voice-call@2026.2.22
  ```


## Technical details

A resource exhaustion vulnerability exists in the @openclaw/voice-call package due to improper WebSocket connection handling. The media-stream path performs a WebSocket upgrade before validating the stream via the shouldAcceptStream() function, which is only triggered after a 'start' frame is received. This allows unauthenticated remote attackers to maintain idle, unvalidated sockets, consuming connection-related resources. If exploited at scale, this leads to a denial-of-service (DoS) condition for legitimate media streams. The fix introduces strict pre-start timeouts and connection caps per IP and globally.

## Affected products

- OpenClaw openclaw <= 2026.2.21-2
- OpenClaw @openclaw/voice-call <= 2026.2.21

## Identifiers

- CVE-2026-32062
- GHSA-mfg5-7q5g-f37j

## Timeline

- 2026-02-23: disclosed: Initial disclosure to vendor
- 2026-03-02: advisory: GitHub Advisory published
- 2026-03-11: other: NVD publication date

## References

- [https://api.github.com/users/jiseoung](https://api.github.com/users/jiseoung)
- [https://github.com/jiseoung](https://github.com/jiseoung)
- [https://api.github.com/users/jiseoung/gists%7B/gist_id%7D](https://api.github.com/users/jiseoung/gists%7B/gist_id%7D)
- [https://api.github.com/users/jiseoung/repos](https://api.github.com/users/jiseoung/repos)
- [https://avatars.githubusercontent.com/u/106800290?v=4](https://avatars.githubusercontent.com/u/106800290?v=4)
- [https://api.github.com/users/jiseoung/events%7B/privacy%7D](https://api.github.com/users/jiseoung/events%7B/privacy%7D)

## Related threats

- [OpenClaw incorrect authorization in mcp.app.view method](https://junglewise.ai/threats/cve-2026-102807-openclaw-before-2026-9-4-contains-an-incorrect-authorization)
- [OpenClaw incorrect authorization in Gateway media root allowlist](https://junglewise.ai/threats/cve-2026-102806-openclaw-before-2026-9-5-contains-an-incorrect-authorization)
- [OpenClaw exec approval bypass in Google Meet node commands](https://junglewise.ai/threats/cve-2026-100599-openclaw-versions-2026-5-1-through-2026-7-0-fail-to-apply-the)
- [OpenClaw Signal approval reaction binding logic error](https://junglewise.ai/threats/cve-2026-100598-openclaw-npm-package-openclaw-before-2026-7-1-incorrectly-binds)
- [OpenClaw time-of-check time-of-use race condition in filesystem operations](https://junglewise.ai/threats/cve-2026-100597-openclaw-npm-package-openclaw-before-2026-7-1-is-vulnerable-to-a)