Executive brief
OpenClaw is a popular media processing library that handles remote media downloads and error responses. A vulnerability allows attackers to send crafted HTTP error responses with large bodies, causing the application to allocate unbounded memory before properly handling the failure, potentially leading to memory exhaustion and service denial.
Technical details
This vulnerability is an unbounded resource consumption flaw (CWE-789/CWE-400) in the remote media HTTP error handling code. The root cause is that error response bodies were being buffered without a size cap before failure handling logic runs. An attacker can send a crafted HTTP error response (non-2xx status) with an arbitrarily large body to remote media endpoints, triggering memory allocation on the server before the failure path is executed. This allows denial of service via memory exhaustion. The fix, shipped in version 2026.3.22, introduces bounded prefix reads and enforces capped memory allocation in the error response handling path.
Affected products
- OpenClaw openclaw < 2026.3.22
Timeline
- 2026-03-24: disclosed: Original advisory published
- 2026-03-22: patched: Fix released in version 2026.3.22
- 2026-04-10: other: Duplicate advisory GHSA-hm63-vwj4-mj2q withdrawn