OpenClaw installations running a version older than 2026.3.2 are susceptible to a denial‑of‑service attack. The vulnerability resides in the parsing of webhook request bodies for BlueBubbles and Google Chat before performing authentication and signature validation. An unauthenticated attacker can send requests with slow or oversized bodies, exhausting parsing resources and temporarily degrading or denying service to legitimate users. This is identified as a CWE‑770 (Uncontrolled Resource Consumption) and is rated as high severity with a CVSS score of 8.7.

Affected systems are those running the OpenClaw web application before version 2026.3.2. The vulnerability impacts the webhook handlers responsible for BlueBubbles and Google Chat integrations and is present in all releases prior to the 2026.3.2 update. The vendor product is listed simply as OpenClaw and is distributed as a Node.js application.

The risk is substantial because the flaw does not require any authentication and can be triggered by any external user capable of reaching the webhook endpoints. Exploitability is straightforward: an attacker crafts slow‑or‑large HTTP request bodies aimed at the webhook URLs, leading to resource exhaustion. The lack of an EPSS score and absence from the CISA KEV catalog does not diminish the theoretical threat, as the CVSS rating remains high and the attack vector is broadly accessible via the public network.