Executive brief
OpenClaw is a platform that handles incoming Telegram webhook notifications. A flaw in the webhook handler allowed attackers to send POST requests without authentication, forcing the server to consume memory, socket time, and processing resources parsing request bodies that should have been rejected immediately. This could lead to denial of service and service unavailability.
Technical details
The vulnerability is a resource exhaustion issue (CWE-770/CWE-400) in the Telegram webhook listener (src/telegram/webhook.ts). The root cause is improper request validation order: the application read and buffered the entire webhook request body before validating the x-telegram-bot-api-secret-token header. An unauthenticated network attacker can send POST requests to the webhook endpoint to force memory allocation, socket I/O, and JSON parsing work before authentication validation occurs, consuming server resources. The fix (OpenClaw 2026.3.13 and later) validates the secret header immediately upon request receipt and rejects unauthenticated requests with a 401 status before invoking body parsing functions.
Affected products
- OpenClaw OpenClaw <=2026.3.12
Timeline
- 2026-03-14: disclosed
- 2026-03-13: patched: Fix released in version 2026.3.13