CVE-2026-28394CWE-770

OpenClaw < 2026.2.15 - Denial of Service via Unbounded Response Parsing in web_fetch Tool

Medium · published March 5, 2026

CVSS v4.0
6.9
EPSS
1%
Percentile
48.0
In the wild
Unconfirmed
What it is

OpenClaw versions prior to 2026.2.15 contain a denial of service vulnerability in the web_fetch tool that allows attackers to crash the Gateway process through memory exhaustion by parsing oversized or deeply nested HTML responses. Remote attackers can social-engineer users into fetching malicious URLs with pathological HTML structures to exhaust server memory and cause service unavailability.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00598 · 48.0th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-03-05T21:59Z
EPSS history
Timeline
  • 05 MAR 21:59Z
    OpenClaw < 2026.2.15 - Denial of Service via Unbounded Response Parsing in web_fetch Tool
    cvelistv5