Junglewise Threat Intelligence

CVE-2026-41400: OpenClaw voice-call resource consumption via oversized WebSocket frames

CVE-2026-41400 · Severity: low · CVSS 3.1 · Published 2026-04-03

Technologies: Openclaw. Vendors: Openclaw.

Executive brief

OpenClaw is an AI automation platform that handles voice calls over WebSocket connections. A vulnerability in the voice-call component allows remote attackers to send oversized WebSocket frames before authentication is validated, causing the application to consume excessive memory and CPU resources. This can lead to service degradation or unavailability for legitimate users.

Technical details

The vulnerability is an uncontrolled resource consumption issue (CWE-400, CWE-770) in OpenClaw's voice-call WebSocket handler. The root cause is that the component processes and allocates memory for oversized pre-authentication WebSocket frames without enforcing payload size limits before start validation. A remote attacker on the network can exploit this by sending specially crafted large WebSocket frames to the voice-call endpoint, bypassing the maxPayload size check that was intended in prior fix attempts. The attacker needs no authentication or user interaction, only network access to the voice-call service. Successful exploitation results in resource exhaustion (memory/CPU), potentially causing denial of service. The fix was released in version 2026.3.31 (commit 9abcfdadf591bf266d85fbdfe14ae833e557a110) and adds proper frame size validation before parsing.

Affected products

  • OpenClaw openclaw <=2026.3.28

Timeline

  • 2026-04-03: disclosed: GitHub Security Advisory GHSA-2w79-r9g8-wmcr published
  • 2026-03-31: patched: Fix commit 9abcfdadf591bf266d85fbdfe14ae833e557a110 merged
  • 2026-04-28: advisory: CVE-2026-41400 published on NVD
  • 2026-03-31: other: Patched version 2026.3.31 released

References

Related threats