CVE-2026-29612CWE-770

OpenClaw < 2026.2.14 - Denial of Service via Large Base64 Media File Decoding

Medium · published March 5, 2026

CVSS v4.0
6.8
EPSS
1%
Percentile
42.0
In the wild
Unconfirmed
What it is

OpenClaw versions prior to 2026.2.14 decode base64-backed media inputs into buffers before enforcing decoded-size budget limits, allowing attackers to trigger large memory allocations. Remote attackers can supply oversized base64 payloads to cause memory pressure and denial of service.

The record
Technical detail
CVSS v4.0
6.8 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00502 · 42.0th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-03-05T22:00Z
EPSS history
Timeline
  • 05 MAR 22:00Z
    OpenClaw < 2026.2.14 - Denial of Service via Large Base64 Media File Decoding
    cvelistv5