Description
OpenClaw before 2026.3.25 parses JSON request bodies before validating webhook signatures, allowing unauthenticated attackers to force resource-intensive parsing operations. Remote attackers can send malicious webhook requests to trigger denial of service by exhausting server resources through forced JSON parsing before signature rejection.
Published: 2026-04-09
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

The vulnerability exists because OpenClaw processes JSON payloads before verifying the webhook signature, allowing attackers to send large or malformed JSON data that causes high CPU and memory usage. This leads to a denial of service by exhausting server resources. The weakness is identified as CWE-696: Unchecked Input for Resource Exhaustion.

Affected Systems

The affected product is OpenClaw, all releases prior to version 2026.3.25. The vendor is OpenClaw. Anyone running an older version is susceptible.

Risk and Exploitability

The CVSS score is 6.9, indicating medium severity, and the vulnerability is not listed in KEV. Exploitation requires only unauthenticated HTTP access to the webhook endpoint, which is typically exposed on the public network. Attackers can craft requests that trigger excessive parsing and consume CPU and memory, leading to service degradation or crash. The lack of authentication and the ability to send arbitrary JSON payloads make this a likely vector on exposed installations.

Generated by OpenCVE AI on April 9, 2026 at 22:38 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the official patch or upgrade OpenClaw to version 2026.3.25 or later.
  • If an immediate upgrade is not possible, restrict network access to the webhook endpoint or configure a firewall rule to limit traffic.
  • As a temporary measure, disable webhook processing until the vulnerability can be remediated.
  • Verify that signature validation occurs before any JSON parsing in custom deployments.

Generated by OpenCVE AI on April 9, 2026 at 22:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-3h52-cx59-c456 OpenClaw: Feishu webhook reads and parses unauthenticated request bodies before signature validation
History

Fri, 10 Apr 2026 13:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 09 Apr 2026 21:45:00 +0000

Type Values Removed Values Added
Description OpenClaw before 2026.3.25 parses JSON request bodies before validating webhook signatures, allowing unauthenticated attackers to force resource-intensive parsing operations. Remote attackers can send malicious webhook requests to trigger denial of service by exhausting server resources through forced JSON parsing before signature rejection.
Title OpenClaw < 2026.3.25 - Denial of Service via Unauthenticated Webhook Request Parsing
First Time appeared Openclaw
Openclaw openclaw
Weaknesses CWE-696
CPEs cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*
Vendors & Products Openclaw
Openclaw openclaw
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Openclaw Openclaw
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-04-10T12:29:52.811Z

Reserved: 2026-04-04T12:30:33.464Z

Link: CVE-2026-35640

cve-icon Vulnrichment

Updated: 2026-04-10T12:29:48.309Z

cve-icon NVD

Status : Analyzed

Published: 2026-04-09T22:16:33.507

Modified: 2026-04-15T19:52:39.630

Link: CVE-2026-35640

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-10T09:28:22Z

Weaknesses