CVE-2026-29609CWE-770

OpenClaw < 2026.2.14 - Denial of Service via Unbounded URL-backed Media Fetch

High · published March 5, 2026

CVSS v4.0
8.7
EPSS
1%
Percentile
56.4
In the wild
Unconfirmed
What it is

OpenClaw versions prior to 2026.2.14 contain a denial of service vulnerability in the fetchWithGuard function that allocates entire response payloads in memory before enforcing maxBytes limits. Remote attackers can trigger memory exhaustion by serving oversized responses without content-length headers to cause availability loss.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00806 · 56.4th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-03-05T22:00Z
EPSS history
Timeline
  • 05 MAR 22:00Z
    OpenClaw < 2026.2.14 - Denial of Service via Unbounded URL-backed Media Fetch
    cvelistv5