OpenClaw versions earlier than 2026.2.14 allow attackers to trigger denial of service by feeding the program high‑expansion ZIP and TAR archives. The vulnerability resides in the extractArchive function in src/infra/archive.ts and enables the attacker to consume excessive CPU, memory, and disk resources, leading to service degradation or system unavailability. This is a classic instance of uncontrolled resource consumption, identified as CWE‑770.

The affected product is OpenClaw, a Node.js application. Any installation of OpenClaw built from source or distributed binaries with a version older than 2026.2.14 is vulnerable. The vulnerability exists in the core archive extraction logic and is not limited to a particular operating system or deployment environment.

The CVSS score of 6.7 indicates a moderate severity, while the EPSS score of less than 1% suggests a low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Remote attackers can potentially exploit the flaw by embedding malicious archives in install or update operations, which are typically executed with elevated privileges. The attack vector is inferred to be remote, via the update mechanism, and would require the attacker to provide a crafted archive to the target system. Given the nature of the resource exhaustion, even a single successful exploit can render the service unavailable to legitimate users.