Executive brief
OpenClaw is a voice communication platform that processes incoming webhook notifications from telephony providers. The vulnerability allows unauthenticated attackers to exhaust server resources by sending oversized request bodies to the voice call webhook handler, since the application buffers these bodies before validating the provider's cryptographic signature. This can lead to denial of service, making the service unavailable to legitimate users.
Technical details
The vulnerability is a resource exhaustion flaw (CWE-400) in OpenClaw's voice call webhook handling. The root cause is that the webhook implementation buffers incoming request bodies into memory before performing authentication checks (provider signature validation). An attacker can send unauthenticated, oversized HTTP requests to the webhook endpoint without network authentication, causing the application to consume excessive memory or processing resources. While the vulnerability is "bounded" (limited by some cap), it still enables denial-of-service attacks. The fix in version 2026.3.22 enforces header gating and pre-authentication body size limits before buffering attacker-controlled request bodies.
Affected products
- OpenClaw openclaw < 2026.3.22
Timeline
- 2026-03-26: disclosed
- 2026-03-22: patched: Fix shipped in version 2026.3.22