The reported vulnerability exists in OpenClaw versions 2026.2.21 through 2026.2.22. Unauthenticated users can initiate a WebSocket upgrade for a media stream before the stream is validated, allowing them to maintain idle connections that consume server resources and degrade availability for legitimate users. This weakness is characterised as resource exhaustion (CWE‑770) and can result in a denial‑of‑service scenario.

OpenClaw’s primary product, the OpenClaw platform, and its voice‑call component (openclaw:voice‑call) are affected. Versions 2026.2.21‑2 of the main application and 2026.2.21 of the voice‑call module are vulnerable; upgrading to version 2026.2.22 or later resolves the issue.

The CVSS base score of 8.7 classifies the issue as high severity, while the EPSS score of less than 1% indicates a relatively low likelihood of seeing an active exploitation. The vulnerability is not yet listed in the CISA KEV catalog, suggesting no known widespread exploitation. Attackers need not authenticate; any client able to reach the media‑stream WebSocket endpoint can abuse the flaw simply by opening and keeping the connection idle, making the attack vector likely to be network‑based.