Executive brief
OpenClaw, a package used for voice-call functionality, contains a vulnerability where it fails to properly limit the size of incoming data packets over its real-time communication channel. An attacker can exploit this by sending excessively large messages, potentially causing the service to crash or become unavailable. This could disrupt voice communication services for all users of the affected application.
Technical details
A resource consumption vulnerability (CWE-400/CWE-770) exists in the OpenClaw voice-call realtime WebSocket implementation. The component fails to validate or enforce limits on the size of incoming WebSocket frames before processing them. A remote, unauthenticated attacker can exploit this by sending oversized frames over the network to the exposed webhook path, leading to excessive memory or CPU consumption and a denial-of-service (DoS) state. The issue is resolved in version 2026.4.10 by implementing checks to reject oversized frames early in the processing pipeline.
Affected products
- openclaw openclaw >= 2026.4.9 < 2026.4.10
Timeline
- 2026-04-16: disclosed
- 2026-04-17: advisory: GitHub Advisory published
- 2026-04-10: patched: First stable tag with fix released