Vulnerability details
CVE-2026-32011
OpenClaw OpenClaw
OpenClaw < 2026.3.2 - Slow-Request Denial of Service via Pre-Auth Webhook Body Parsing
CVSS 4.0
8.7High
Official description
OpenClaw versions prior to 2026.3.2 contain a denial of service vulnerability in webhook handlers for BlueBubbles and Google Chat that parse request bodies before performing authentication and signature validation. Unauthenticated attackers can exploit this by sending slow or oversized request bodies to exhaust parser resources and degrade service availability.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.7High | 4.0 | CVEProject cvelistV5 (CNA) (VulnCheck) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
| 7.5High | 3.1 | CVEProject cvelistV5 (CNA) (VulnCheck) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| OpenClaw | OpenClaw | v < 2026.3.2 | CVEProject cvelistV5 (CNA) |
References and advisories
3- https://github.com/openclaw/openclaw/security/advisories/GHSA-x4vp-4235-65hg vendor-advisory
- https://github.com/openclaw/openclaw/commit/d3e8b17aa6432536806b4853edc7939d891d0f25 patch
- https://www.vulncheck.com/advisories/openclaw-slow-request-denial-of-service-via-pre-auth-webhook-body-parsing third-party-advisory
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-03-20
- Last updated
- 2026-06-23
- State
- Published
- Assigner (CNA)
- VulnCheck
Exploit prediction (EPSS)
0.42%
Probability of exploitation in 30 days
37.3%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- None
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-770Allocation of Resources Without Limits or Throttling