CVE-2026-32980CWE-770

OpenClaw < 2026.3.13 - Resource Exhaustion via Unauthenticated Telegram Webhook Request

High · published March 29, 2026

CVSS v4.0
8.7
EPSS
1%
Percentile
53.6
In the wild
Unconfirmed
What it is

OpenClaw before 2026.3.13 reads and buffers Telegram webhook request bodies before validating the x-telegram-bot-api-secret-token header, allowing unauthenticated attackers to exhaust server resources. Attackers can send POST requests to the webhook endpoint to force memory consumption, socket time, and JSON parsing work before authentication validation occurs.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00728 · 53.6th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-03-29T12:44Z
EPSS history
Timeline
  • 29 MAR 12:44Z
    OpenClaw < 2026.3.13 - Resource Exhaustion via Unauthenticated Telegram Webhook Request
    cvelistv5