Executive brief
OpenClaw is a popular Node.js library used for integrating Feishu (a collaboration platform) webhooks into applications. The vulnerability allows unauthenticated attackers to send specially crafted webhook requests that trigger expensive JSON parsing operations before signature validation occurs, exhausting server resources and causing denial of service without needing valid credentials.
Technical details
The vulnerability is a denial of service issue in OpenClaw's Feishu webhook handler caused by parsing JSON request bodies before validating webhook signatures (CWE-400: Uncontrolled Resource Consumption). The vulnerable code processes and parses incoming JSON data before checking the authenticity of the request, allowing remote network-based attackers to send malicious webhook payloads that force computationally expensive parsing operations to complete even when the signature is invalid. No authentication is required. The fix (commit 5e8cb22176e9235e224be0bc530699261eb60e53) reorders operations to validate the signature first on the raw request body, then parse JSON only for authenticated requests. Patched in version 2026.3.25.
Affected products
- OpenClaw OpenClaw <= 2026.3.24
Timeline
- 2026-03-26: disclosed
- 2026-03-26: patched: Fix commit 5e8cb22176e9235e224be0bc530699261eb60e53 published; version 2026.3.25 planned
- 2026-04-10: advisory: Withdrawn as duplicate of GHSA-3h52-cx59-c456