Description (CNA)
OpenClaw versions prior to 2026.2.14 decode base64-backed media inputs into buffers before enforcing decoded-size budget limits, allowing attackers to trigger large memory allocations. Remote attackers can supply oversized base64 payloads to cause memory pressure and denial of service.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| OpenClaw / OpenClaw | affected 0 before 2026.2.14 |
CWE
CWE-770
References
- https://github.com/openclaw/openclaw/security/advisories/GHSA-w2cg-vxx6-5xjg
- https://github.com/openclaw/openclaw/commit/31791233d60495725fa012745dde8d6ee69e9595
- https://www.vulncheck.com/advisories/openclaw-denial-of-service-via-large-base-media-file-decoding
ADP enrichment
No English description supplied.
No references supplied.