The vulnerability allows unauthenticated attackers to force the OpenClaw server to read and buffer Telegram webhook request bodies before validating the required authentication header. This unvalidated processing consumes memory, socket time, and JSON parsing resources, effectively creating a denial‑of‑service condition. The weakness is a classic resource‑exhaustion flaw, identified as CWE‑770, and can be leveraged by attackers to degrade the availability of services that rely on the webhook endpoint.

The affected product is OpenClaw by OpenClaw. Versions earlier than 2026.3.13 are vulnerable. No other vendors or products are listed. The vulnerability is tied to the OpenClaw instance that exposes the Telegram webhook endpoint.

The CVSS score of 8.7 signals a high severity. The lack of an EPSS score means we cannot gauge current exploitation rate from the dataset, but the vulnerability is not yet cataloged under CISA's KEV. The likely attack vector is unauthenticated network requests to the exposed webhook endpoint. An attacker can craft large POST payloads, triggering excessive memory consumption and parsing effort before the authentication header is checked. The exploit requires only network access to the webhook URL; no special credentials are needed. If successful, it can exhaust system resources and lead to denial of service for legitimate users.