OpenClaw versions prior to 2026.2.15 feature a flaw in the web_fetch tool that fails to limit the size or depth of HTML responses, allowing an attacker to cause memory exhaustion and force the Gateway process to terminate. This resource‑exhaustion weakness can be triggered by supplying a malicious URL that contains an unusually large or deeply nested HTML structure, which typically requires only social engineering to persuade a user or application to fetch the crafted content. The resulting denial of service impacts the availability of the OpenClaw gateway service for all users served by the affected instance.

The vulnerability impacts all installations of the OpenClaw gateway running any version earlier than 2026.2.15, specifically the web_fetch component. Users who deploy OpenClaw on any operating system without a recent upgrade are potentially affected. No additional vendor or version details were provided beyond the upstream product name.

The CVSS score of 6.9 indicates medium severity, while the EPSS score of less than 1% implies a low likelihood of exploitation in the wild. The flaw is not listed in the CISA KEV catalog, suggesting no known active exploits at this time. The attack vector is remote, but it depends on social engineering or a phishing scenario to make legitimate users request the malicious URL. Once a request is made, the Gateway process can be forced into an out‑of‑memory state without requiring elevated privileges or local access.