Junglewise Threat Intelligence

OpenClaw unbounded memory allocation in remote media error handling

Severity: medium · CVSS 5.3 · Published 2026-04-10

Technologies: Openclaw. Vendors: Openclaw.

Executive brief

OpenClaw is a library used for handling media and remote content. A vulnerability exists where the software fails to limit the amount of memory it uses when receiving error messages from remote servers. An attacker could exploit this by sending a specially crafted, large error response, potentially causing the application to crash or become unresponsive due to memory exhaustion.

Technical details

OpenClaw before version 2026.3.22 is vulnerable to uncontrolled resource consumption (CWE-400/CWE-789) within its remote media fetching component. The root cause is that HTTP error response bodies were read and buffered into memory without a hard size limit before failure handling occurred. A remote attacker can exploit this by serving a crafted HTTP error response with an extremely large body to an OpenClaw media endpoint. This results in unbounded memory allocation, leading to a denial-of-service (DoS) condition. The issue was addressed in version 2026.3.22 by implementing bounded prefix reads and enforcing capped buffers in src/media/fetch.ts and src/media/read-response-with-limit.ts.

Affected products

  • OpenClaw openclaw < 2026.3.22

Timeline

  • 2026-03-22: patched: Fix committed to repository
  • 2026-03-24: advisory: Original GHSA-4qwc-c7g9-4xcw published
  • 2026-04-09: advisory: CVE-2026-35633 assigned
  • 2026-04-10: disclosed: Duplicate advisory GHSA-hm63-vwj4-mj2q published and withdrawn

References

Related threats