Most recent entries from all

BREW-openclaw-cli-CVE-2026-32049 — OpenClaw's inbound media downloads could exceed configured byte limits before rejection across multiple channels

Affected: Homebrew: openclaw-cli

## Summary OpenClaw did not consistently enforce configured inbound media byte limits before buffering remote media in several channel ingestion paths. A remote sender could trigger oversized downloads and memory pressure before rejection.

## Affected Packages / Versions - Package: `openclaw` (npm) - Affected versions: `<= 2026.2.21-2` (latest published at triage time) - Fixed in: `2026.2.22` (planned next release)

## Impact An attacker could cause elevated memory usage and potential process instability (denial of service) by sending oversized media payloads.

## Fix Commit(s) - `73d93dee64127a26f1acd09d0403b794cdeb4f5c`

## Release Process Note `patched_versions` is pre-set to the planned next release (`2026.2.22`). After that npm release is published, this advisory can be published without further version-field edits.

OpenClaw thanks @tdjackey for reporting.

cnvd-2026-16053

EUVD-2026-329444

fkie_cve-2026-32049

OpenClaw versions prior to 2026.2.22 fail to consistently enforce configured inbound media byte limits before buffering remote media across multiple channel ingestion paths. Remote attackers can send oversized media payloads to trigger elevated memory usage and potential process instability.

GHSA-rxxp-482v-7mrh — OpenClaw's inbound media downloads could exceed configured byte limits before rejection across multiple channels

Affected: npm: openclaw

## Affected Packages / Versions - Package: `openclaw` (npm) - Affected versions: `<= 2026.2.21-2` (latest published at triage time) - Fixed in: `2026.2.22` (planned next release)

## Impact An attacker could cause elevated memory usage and potential process instability (denial of service) by sending oversized media payloads.

## Fix Commit(s) - `73d93dee64127a26f1acd09d0403b794cdeb4f5c`

OpenClaw thanks @tdjackey for reporting.

WID-SEC-W-2026-0472 — OpenClaw: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um beliebigen Programmcode auszuführen, sich erhöhte Berechtigungen zu verschaffen, Daten zu manipulieren, einen Denial-of-Service-Zustand auszulösen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen oder andere nicht näher spezifizierte Angriffe durchzuführen.