https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T14:00:39.795568+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/brew-openclaw-cli-cve-2026-32049 BREW-openclaw-cli-CVE-2026-32049 — OpenClaw's inbound media downloads could exceed configured byte limits before rejection across multiple channels 2026-10-03T14:00:39.802360+00:00

Affected: Homebrew: openclaw-cli

## Summary OpenClaw did not consistently enforce configured inbound media byte limits before buffering remote media in several channel ingestion paths. A remote sender could trigger oversized downloads and memory pressure before rejection.

## Affected Packages / Versions - Package: `openclaw` (npm) - Affected versions: `<= 2026.2.21-2` (latest published at triage time) - Fixed in: `2026.2.22` (planned next release)

## Impact An attacker could cause elevated memory usage and potential process instability (denial of service) by sending oversized media payloads.

## Fix Commit(s) - `73d93dee64127a26f1acd09d0403b794cdeb4f5c`

## Release Process Note `patched_versions` is pre-set to the planned next release (`2026.2.22`). After that npm release is published, this advisory can be published without further version-field edits.

OpenClaw thanks @tdjackey for reporting.

 https://cve.radiocsirt.org/vuln/cnvd-2026-16053 cnvd-2026-16053 2026-10-03T14:00:39.802419+00:00 cnvd-2026-16053 https://cve.radiocsirt.org/vuln/euvd-2026-329444 EUVD-2026-329444 2026-10-03T14:00:39.802437+00:00 EUVD-2026-329444 https://cve.radiocsirt.org/vuln/fkie_cve-2026-32049 fkie_cve-2026-32049 2026-10-03T14:00:39.802449+00:00

OpenClaw versions prior to 2026.2.22 fail to consistently enforce configured inbound media byte limits before buffering remote media across multiple channel ingestion paths. Remote attackers can send oversized media payloads to trigger elevated memory usage and potential process instability.

 https://cve.radiocsirt.org/vuln/ghsa-rxxp-482v-7mrh GHSA-rxxp-482v-7mrh — OpenClaw's inbound media downloads could exceed configured byte limits before rejection across multiple channels 2026-10-03T14:00:39.802469+00:00

Affected: npm: openclaw

## Summary OpenClaw did not consistently enforce configured inbound media byte limits before buffering remote media in several channel ingestion paths. A remote sender could trigger oversized downloads and memory pressure before rejection.

## Affected Packages / Versions - Package: `openclaw` (npm) - Affected versions: `<= 2026.2.21-2` (latest published at triage time) - Fixed in: `2026.2.22` (planned next release)

## Impact An attacker could cause elevated memory usage and potential process instability (denial of service) by sending oversized media payloads.

## Fix Commit(s) - `73d93dee64127a26f1acd09d0403b794cdeb4f5c`

## Release Process Note `patched_versions` is pre-set to the planned next release (`2026.2.22`). After that npm release is published, this advisory can be published without further version-field edits.

OpenClaw thanks @tdjackey for reporting.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0472 WID-SEC-W-2026-0472 — OpenClaw: Mehrere Schwachstellen 2026-10-03T14:00:39.802497+00:00

Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um beliebigen Programmcode auszuführen, sich erhöhte Berechtigungen zu verschaffen, Daten zu manipulieren, einen Denial-of-Service-Zustand auszulösen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen oder andere nicht näher spezifizierte Angriffe durchzuführen.