https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T00:55:57.892159+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/brew-openclaw-cli-cve-2026-28452 BREW-openclaw-cli-CVE-2026-28452 — OpenClaw affected by denial of service through unguarded archive extraction allowing high expansion/resource abuse (ZIP… 2026-10-04T00:55:57.896009+00:00

Affected: Homebrew: openclaw-cli

## Summary Archive extraction lacked strict resource budgets, allowing high-expansion ZIP/TAR archives to consume excessive CPU/memory/disk during install/update flows.

## Affected Packages / Versions - openclaw (npm): <= 2026.2.13 - clawdbot (npm): <= 2026.1.24-3

## Details Affected component: `src/infra/archive.ts` (`extractArchive`).

The extractor now enforces resource budgets (entry count and extracted byte limits; ZIP also enforces a compressed archive size limit) and rejects over-budget archives.

## Fix Commit(s) - openclaw/openclaw@d3ee5deb87ee2ad0ab83c92c365611165423cb71 - openclaw/openclaw@5f4b29145c236d124524c2c9af0f8acd048fbdea

## Release Process Note This advisory will be updated with patched versions once the next npm release containing the fix is published.

## Credits Thanks @vincentkoc for reporting.

 https://cve.radiocsirt.org/vuln/cnvd-2026-13543 cnvd-2026-13543 2026-10-04T00:55:57.896099+00:00 cnvd-2026-13543 https://cve.radiocsirt.org/vuln/euvd-2026-274942 EUVD-2026-274942 2026-10-04T00:55:57.896124+00:00 EUVD-2026-274942 https://cve.radiocsirt.org/vuln/fkie_cve-2026-28452 fkie_cve-2026-28452 2026-10-04T00:55:57.896144+00:00

OpenClaw versions prior to 2026.2.14 contain a denial of service vulnerability in the extractArchive function within src/infra/archive.ts that allows attackers to consume excessive CPU, memory, and disk resources through high-expansion ZIP and TAR archives. Remote attackers can trigger resource exhaustion by providing maliciously crafted archive files during install or update operations, causing service degradation or system unavailability.

 https://cve.radiocsirt.org/vuln/ghsa-h89v-j3x9-8wqj GHSA-h89v-j3x9-8wqj — OpenClaw affected by denial of service through unguarded archive extraction allowing high expansion/resource abuse (ZIP… 2026-10-04T00:55:57.896183+00:00

Affected: npm: openclaw, npm: clawdbot

## Summary Archive extraction lacked strict resource budgets, allowing high-expansion ZIP/TAR archives to consume excessive CPU/memory/disk during install/update flows.

## Affected Packages / Versions - openclaw (npm): <= 2026.2.13 - clawdbot (npm): <= 2026.1.24-3

## Details Affected component: `src/infra/archive.ts` (`extractArchive`).

The extractor now enforces resource budgets (entry count and extracted byte limits; ZIP also enforces a compressed archive size limit) and rejects over-budget archives.

## Fix Commit(s) - openclaw/openclaw@d3ee5deb87ee2ad0ab83c92c365611165423cb71 - openclaw/openclaw@5f4b29145c236d124524c2c9af0f8acd048fbdea

## Release Process Note This advisory will be updated with patched versions once the next npm release containing the fix is published.

## Credits Thanks @vincentkoc for reporting.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0424 WID-SEC-W-2026-0424 — OpenClaw: Mehrere Schwachstellen 2026-10-04T00:55:57.896242+00:00

Ein Angreifer kann diese Schwachstellen in OpenClaw ausnutzen, um beliebigen Programmcode auszuführen, sich erhöhte Berechtigungen zu verschaffen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen oder andere, nicht näher bezeichnete Angriffe durchzuführen.