CVE-2026-35640CWE-696

OpenClaw < 2026.3.25 - Denial of Service via Unauthenticated Webhook Request Parsing

Medium · published April 9, 2026

CVSS v4.0
6.9
EPSS
1%
Percentile
55.9
In the wild
Unconfirmed
What it is

OpenClaw before 2026.3.25 parses JSON request bodies before validating webhook signatures, allowing unauthenticated attackers to force resource-intensive parsing operations. Remote attackers can send malicious webhook requests to trigger denial of service by exhausting server resources through forced JSON parsing before signature rejection.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS
0.00793 · 55.9th percentile
Weakness
CWE-696 · Incorrect Behavior Order
Published
2026-04-09T21:27Z
EPSS history
Timeline
  • 09 APR 21:27Z
    OpenClaw < 2026.3.25 - Denial of Service via Unauthenticated Webhook Request Parsing
    cvelistv5