At the time of processing, OpenClaw executes cryptographic and dispatch procedures on inbound Nostr direct messages before validating the sender and pairing policy. As a result, an attacker can send specially crafted DM messages to trigger unauthorized pre‑authentication computation, consuming significant CPU and memory resources and causing the service to become unavailable. This vulnerability is a classic Denial of Service scenario that affects confidentiality and integrity only if the attacker can also gain access after the exhaustion, which the description does not indicate.

The affected vendor is OpenClaw, product OpenClaw. All releases prior to version 2026.3.22 are affected. No other vendor products are listed.

The CVSS score of 6.9 indicates a moderate severity. The attack does not require authentication and relies on sending malformed DM messages over the network, making it relatively easy to exploit for anyone with network access to the Nostr endpoint. EPSS information is unavailable, and the vulnerability is not cataloged in CISA’s KEV database. Because the impact is limited to service availability, the broader threat is a denial of service rather than data compromise.