Description (CNA)
OpenClaw versions prior to 2026.2.22 fail to consistently enforce configured inbound media byte limits before buffering remote media across multiple channel ingestion paths. Remote attackers can send oversized media payloads to trigger elevated memory usage and potential process instability.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| OpenClaw / OpenClaw | affected 0 before 2026.2.22; unaffected 2026.2.22 |
CWE
CWE-770
References
- https://github.com/openclaw/openclaw/security/advisories/GHSA-rxxp-482v-7mrh
- https://github.com/openclaw/openclaw/commit/73d93dee64127a26f1acd09d0403b794cdeb4f5c
- https://www.vulncheck.com/advisories/openclaw-denial-of-service-via-inbound-media-download-byte-limit-bypass
ADP enrichment
No English description supplied.
No references supplied.