CVE-2026-28452CWE-770

OpenClaw < 2026.2.14 - Denial of Service via Unguarded Archive Extraction in extractArchive

Medium · published March 5, 2026

CVSS v4.0
6.7
EPSS
0%
Percentile
40.1
In the wild
Unconfirmed
What it is

OpenClaw versions prior to 2026.2.14 contain a denial of service vulnerability in the extractArchive function within src/infra/archive.ts that allows attackers to consume excessive CPU, memory, and disk resources through high-expansion ZIP and TAR archives. Remote attackers can trigger resource exhaustion by providing maliciously crafted archive files during install or update operations, causing service degradation or system unavailability.

The record
Technical detail
CVSS v4.0
6.7 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00475 · 40.1th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-03-05T21:59Z
EPSS history
Timeline
  • 05 MAR 21:59Z
    OpenClaw < 2026.2.14 - Denial of Service via Unguarded Archive Extraction in extractArchive
    cvelistv5