https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T10:38:12.291211+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/brew-openclaw-cli-cve-2026-35626 BREW-openclaw-cli-CVE-2026-35626 — OpenClaw is vulnerable to unauthenticated resource exhaustion through its voice call webhook handling 2026-10-03T10:38:12.370179+00:00

Affected: Homebrew: openclaw-cli

## Summary Voice Call webhook handling buffered request bodies before provider signature checks, enabling bounded unauthenticated resource exhaustion.

## Affected Packages / Versions - Package: `openclaw` (npm) - Affected: < 2026.3.22 - Fixed: >= 2026.3.22 - Latest released tag checked: `v2026.3.23-2` (`630f1479c44f78484dfa21bb407cbe6f171dac87`) - Latest published npm version checked: `2026.3.23-2`

## Fix Commit(s) - `651dc7450b68a5396a009db78ef9382633707ead`

## Release Status The fix shipped in `v2026.3.22` and remains present in `v2026.3.23` and `v2026.3.23-2`.

## Code-Level Confirmation - extensions/voice-call/src/webhook.ts now enforces header gating and shared pre-auth body caps before reading attacker-controlled request bodies. - extensions/voice-call/src/webhook.test.ts ships regression coverage for missing-signature, oversize, and timeout pre-auth webhook cases.

OpenClaw thanks @SEORY0 for reporting.

 https://cve.radiocsirt.org/vuln/cnvd-2026-21188 cnvd-2026-21188 2026-10-03T10:38:12.370244+00:00 cnvd-2026-21188 https://cve.radiocsirt.org/vuln/euvd-2026-329504 EUVD-2026-329504 2026-10-03T10:38:12.370264+00:00 EUVD-2026-329504 https://cve.radiocsirt.org/vuln/fkie_cve-2026-35626 fkie_cve-2026-35626 2026-10-03T10:38:12.370276+00:00

OpenClaw before 2026.3.22 contains an unauthenticated resource exhaustion vulnerability in voice call webhook handling that buffers request bodies before provider signature checks. Attackers can send large or malicious webhook requests to exhaust server resources without authentication by bypassing signature validation.

 https://cve.radiocsirt.org/vuln/ghsa-rm59-992w-x2mv GHSA-rm59-992w-x2mv — OpenClaw is vulnerable to unauthenticated resource exhaustion through its voice call webhook handling 2026-10-03T10:38:12.370298+00:00

Affected: npm: openclaw

## Summary Voice Call webhook handling buffered request bodies before provider signature checks, enabling bounded unauthenticated resource exhaustion.

## Affected Packages / Versions - Package: `openclaw` (npm) - Affected: < 2026.3.22 - Fixed: >= 2026.3.22 - Latest released tag checked: `v2026.3.23-2` (`630f1479c44f78484dfa21bb407cbe6f171dac87`) - Latest published npm version checked: `2026.3.23-2`

## Fix Commit(s) - `651dc7450b68a5396a009db78ef9382633707ead`

## Release Status The fix shipped in `v2026.3.22` and remains present in `v2026.3.23` and `v2026.3.23-2`.

## Code-Level Confirmation - extensions/voice-call/src/webhook.ts now enforces header gating and shared pre-auth body caps before reading attacker-controlled request bodies. - extensions/voice-call/src/webhook.test.ts ships regression coverage for missing-signature, oversize, and timeout pre-auth webhook cases.

OpenClaw thanks @SEORY0 for reporting.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0856 WID-SEC-W-2026-0856 — OpenClaw: Mehrere Schwachstellen 2026-10-03T10:38:12.370327+00:00

Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um beliebigen Code auszuführen, erweiterte Berechtigungen – sogar Administratorrechte – zu erlangen, Daten zu manipulieren, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuführen oder andere, nicht näher spezifizierte Angriffe durchzuführen.