CVE-2026-32049CWE-770

OpenClaw < 2026.2.22 - Denial of Service via Inbound Media Download Byte Limit Bypass

High · published March 21, 2026

CVSS v4.0
8.7
EPSS
1%
Percentile
55.7
In the wild
Unconfirmed
What it is

OpenClaw versions prior to 2026.2.22 fail to consistently enforce configured inbound media byte limits before buffering remote media across multiple channel ingestion paths. Remote attackers can send oversized media payloads to trigger elevated memory usage and potential process instability.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00788 · 55.7th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-03-21T00:42Z
EPSS history
Timeline
  • 21 MAR 00:42Z
    OpenClaw < 2026.2.22 - Denial of Service via Inbound Media Download Byte Limit Bypass
    cvelistv5