CVE-2026-41343CWE-799

OpenClaw < 2026.3.31 - Denial of Service via LINE Webhook Handler Pre-Auth Concurrency

Medium · published April 23, 2026

CVSS v4.0
6.9
EPSS
1%
Percentile
56.4
In the wild
Unconfirmed
What it is

OpenClaw before 2026.3.31 lacks a shared pre-auth concurrency budget on the public LINE webhook path, allowing attackers to cause transient availability loss. Remote attackers can flood the webhook endpoint with concurrent requests before signature verification to exhaust resources and degrade service availability.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS
0.00807 · 56.4th percentile
Weakness
CWE-799 · Improper Control of Interaction Frequency
Published
2026-04-23T21:58Z
EPSS history
Timeline
  • 23 APR 21:58Z
    OpenClaw < 2026.3.31 - Denial of Service via LINE Webhook Handler Pre-Auth Concurrency
    cvelistv5