OpenClaw versions prior to 2026.3.1 contain an unbounded memory growth flaw in the Zalo webhook endpoint. The server stores every unique query string key in memory without restraint, causing memory pressure, process instability, and potentially out‑of‑memory conditions that degrade service availability. Attackers can trigger this effect through unauthenticated HTTP requests by repeatedly sending requests with varying query parameters, forcing the application to grow its in‑memory key store indefinitely.

The vulnerability affects all deployments of the OpenClaw application running versions earlier than 2026.3.1, regardless of operating environment, as the issue resides in the core Node.js implementation of the Zalo webhook handler.

The flaw has a CVSS score of 8.7, indicating high severity. No EPSS score is currently available, and the vulnerability is not listed in the CISA KEV catalog. Because the attack vector is unauthenticated and requires only repeated external requests, the potential for exploitation is significant, especially against publicly exposed webhook endpoints.