Executive brief
OpenClaw is an automation platform that integrates with various messaging services. A vulnerability in its Feishu extension allows an unauthenticated attacker to crash or slow down the service by sending specially crafted, slow network requests. This can prevent the bot from receiving legitimate messages and disrupt business operations.
Technical details
The Feishu extension in OpenClaw fails to implement the tightened pre-authentication body parsing limits introduced in a previous security patch. Specifically, the Feishu webhook handler in `extensions/feishu/src/monitor.ts` uses permissive limits (1MB body size and 30-second timeout) before performing signature verification. An attacker can exploit this by initiating multiple concurrent 'Slowloris' style HTTP POST requests, trickling data slowly to hold connections open for the full 30-second window. This leads to connection exhaustion and memory consumption, effectively blocking legitimate webhook deliveries. The issue is resolved in version 2026.3.24.
Affected products
- openclaw openclaw <= 2026.2.22
Timeline
- 2026-03-27: advisory: GHSA-w6m8-cqvj-pg5v published
- 2026-03-24: patched: Fixed in version 2026.3.24
References
- https://github.com/openclaw/openclaw/security/advisories/GHSA-w6m8-cqvj-pg5v
- https://github.com/openclaw/openclaw/security/advisories/GHSA-x4vp-4235-65hg
- https://www.vulncheck.com/advisories/openclaw-denial-of-service-via-feishu-webhook-pre-auth-body-parsing
- https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-w6m8-cqvj-pg5v