The vulnerability occurs when OpenClaw processes remote media HTTP error responses. Crafted error messages with exceptionally large bodies trigger the application to allocate memory without bounds before it can handle the error, leading to excessive memory consumption that can degrade performance or crash the service. This is a classic uncontrolled memory allocation flaw (CWE-770, CWE-789) that provides attackers with a means to disrupt availability.

OpenClaw OpenClaw is impacted. All instances running a version earlier than 2026.3.22 are vulnerable. The issue is tied to the media endpoint handling within the application.

The CVSS score of 6.9 indicates moderate severity. Because the flaw is exploitable remotely through crafted HTTP requests, an attacker with network access to the media endpoints could trigger the denial of service. The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, suggesting that, while the risk is tangible, it may not yet be widely observed. Nevertheless, the lack of mitigation could allow attackers to exhaust server resources, affecting all users of the affected service.