Executive brief
OpenClaw is an automation platform that integrates with third-party services like Feishu via webhooks. A vulnerability in how it handles these incoming messages allows an attacker to send large or complex data that the server tries to process before checking if the sender is legitimate. This can lead to a denial-of-service condition, where the server becomes slow or unresponsive, disrupting automated workflows and business operations.
Technical details
OpenClaw (npm package) versions up to and including 2026.3.24 contain an 'Incorrect Behavior Order' (CWE-696) vulnerability in the Feishu webhook ingress component. The application parses the JSON request body before performing cryptographic signature validation. An unauthenticated remote attacker can exploit this by sending specially crafted, resource-intensive JSON payloads that exhaust CPU or memory during the parsing phase, even if the signature is ultimately rejected. This results in a denial-of-service (DoS) condition. The fix, introduced in version 2026.3.25, ensures the raw request body is validated against the signature before any JSON parsing occurs.
Affected products
- openclaw openclaw <= 2026.3.24
Timeline
- 2026-03-26: patched: Fix committed to main branch
- 2026-03-26: advisory: Original internal advisory GHSA-3h52-cx59-c456 published
- 2026-04-09: advisory: NVD published CVE-2026-35640
- 2026-04-10: disclosed: Duplicate advisory GHSA-8f9r-gr6r-x63q published and withdrawn