Description
OpenClaw versions before 2026.8.1 contain a resource exhaustion vulnerability in the Gateway listener that allows unauthenticated clients to retain response sockets by sending WebSocket upgrade requests without matching connection semantics. Attackers can repeatedly send malformed upgrade requests to exhaust listener resources and cause denial of service without consuming the WebSocket pre-auth connection budget.
Published: 2026-09-26
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Patch Immediately
AI Analysis

Impact

OpenClaw versions before 2026.8.1 contain a resource exhaustion flaw in the Gateway listener. Unauthenticated clients can keep response sockets open by sending WebSocket upgrade requests that do not match the expected connection protocol. This allows attackers to repeatedly send malformed upgrade requests, causing the listener to consume resources until it can no longer accept legitimate connections, leading to a denial of service.

Affected Systems

The affected product is OpenClaw from the vendor OpenClaw. All releases prior to version 2026.8.1 are vulnerable. No specific minor version ranges are listed, so any build before 2026.8.1 may be impacted.

Risk and Exploitability

The CVSS score of 8.7 indicates a high severity flaw. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The vulnerability is exploitable from the network by any unauthenticated client. Attackers can send repeated malformed WebSocket upgrade requests to exhaust the Gateway listener's resources and cause a denial of service. The flaw does not require authentication, privileged access, or additional exploits to be triggered.

Generated by OpenCVE AI on September 26, 2026 at 04:35 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade OpenClaw to version 2026.8.1 or later to apply the vendor fix for the resource exhaustion vulnerability.
  • Implement network-level controls, such as rate limiting or firewall rules, to restrict the rate of WebSocket upgrade traffic from unauthenticated sources.
  • Enable application monitoring for repeated WebSocket upgrade requests and configure alerts to detect potential denial-of-service attempts.

Generated by OpenCVE AI on September 26, 2026 at 04:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 28 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 26 Sep 2026 02:30:00 +0000

Type Values Removed Values Added
Description OpenClaw versions before 2026.8.1 contain a resource exhaustion vulnerability in the Gateway listener that allows unauthenticated clients to retain response sockets by sending WebSocket upgrade requests without matching connection semantics. Attackers can repeatedly send malformed upgrade requests to exhaust listener resources and cause denial of service without consuming the WebSocket pre-auth connection budget.
Title OpenClaw before 2026.8.1 Resource Exhaustion via WebSocket Upgrade
First Time appeared Openclaw
Openclaw openclaw
Weaknesses CWE-400
CPEs cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*
Vendors & Products Openclaw
Openclaw openclaw
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Openclaw Openclaw
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-28T17:38:11.262Z

Reserved: 2026-09-26T01:02:38.348Z

Link: CVE-2026-100558

cve-icon Vulnrichment

Updated: 2026-09-28T17:38:04.315Z

cve-icon NVD

Status : Deferred

Published: 2026-09-26T03:17:02.533

Modified: 2026-09-28T18:17:12.803

Link: CVE-2026-100558

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-26T08:15:09Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption