https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T20:24:56.679240+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/brew-openclaw-cli-cve-2026-42437 BREW-openclaw-cli-CVE-2026-42437 — OpenClaw: Voice-call realtime WebSocket accepted oversized frames 2026-10-04T20:24:56.734076+00:00

Affected: Homebrew: openclaw-cli

## Summary

Voice-call realtime WebSocket accepted oversized frames.

## Affected Packages / Versions

- Package: `openclaw` - Ecosystem: npm - Affected versions: `>= 2026.4.9 < 2026.4.10` - Patched versions: `>= 2026.4.10`

## Impact

The voice-call realtime WebSocket path could accept oversized frames, creating a remote availability risk for deployments exposing that webhook path.

## Technical Details

The fix rejects oversized realtime WebSocket frames before processing them.

## Fix

The issue was fixed in #63890. The first stable tag containing the fix is `v2026.4.10`, and `openclaw@2026.4.14` includes the fix.

## Fix Commit(s)

- `afadb7dae6738819ad9c7d2597ace0516957d20e` - PR: #63890

## Release Process Note

Users should upgrade to `openclaw` 2026.4.10 or newer. The latest npm release, `2026.4.14`, already includes the fix.

## Reporters

Thanks to G0odUser from ADLab of VenusTech Thanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.

 https://cve.radiocsirt.org/vuln/euvd-2026-321250 EUVD-2026-321250 2026-10-04T20:24:56.734181+00:00 EUVD-2026-321250 https://cve.radiocsirt.org/vuln/fkie_cve-2026-42437 fkie_cve-2026-42437 2026-10-04T20:24:56.734204+00:00

OpenClaw versions 2026.4.9 before 2026.4.10 contain a denial of service vulnerability in the voice-call realtime WebSocket path that accepts oversized frames without proper validation. Remote attackers can send oversized WebSocket frames to cause service unavailability for deployments exposing the voice-call realtime WebSocket path.

 https://cve.radiocsirt.org/vuln/ghsa-vw3h-q6xq-jjm5 GHSA-vw3h-q6xq-jjm5 — OpenClaw: Voice-call realtime WebSocket accepted oversized frames 2026-10-04T20:24:56.734272+00:00

Affected: npm: openclaw

## Summary

Voice-call realtime WebSocket accepted oversized frames.

## Affected Packages / Versions

- Package: `openclaw` - Ecosystem: npm - Affected versions: `>= 2026.4.9 < 2026.4.10` - Patched versions: `>= 2026.4.10`

## Impact

The voice-call realtime WebSocket path could accept oversized frames, creating a remote availability risk for deployments exposing that webhook path.

## Technical Details

The fix rejects oversized realtime WebSocket frames before processing them.

## Fix

The issue was fixed in #63890. The first stable tag containing the fix is `v2026.4.10`, and `openclaw@2026.4.14` includes the fix.

## Fix Commit(s)

- `afadb7dae6738819ad9c7d2597ace0516957d20e` - PR: #63890

## Release Process Note

Users should upgrade to `openclaw` 2026.4.10 or newer. The latest npm release, `2026.4.14`, already includes the fix.

## Reporters

Thanks to G0odUser from ADLab of VenusTech Thanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1161 WID-SEC-W-2026-1161 — OpenClaw: Mehrere Schwachstellen 2026-10-04T20:24:56.734351+00:00

Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um erweiterte Rechte zu erlangen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen oder zu manipulieren oder andere, nicht näher spezifizierte Angriffe durchzuführen.