OpenClaw versions before 2026.3.24 contain an incomplete remediation of a previous vulnerability. The Feishu webhook handler processes incoming request bodies with a permissive 1 MB size limit and allows a 30‑second timeout before verifying the request signature. An attacker who does not need authentication can initiate multiple slow HTTP POST requests to the webhook endpoint, consuming server connection resources and exhausting available connections. This results in legitimate webhook deliveries being blocked, effectively denying service to authorized operations. The weakness is a form of input validation error, specifically an over‑permissive request size and timeout handling, mapped to CWE‑405.

OpenClaw software before release 2026.3.24. Users running any OpenClaw version below the mentioned patch are affected.

The vulnerability scores 6.9 on the CVSS scale, placing it in the high‑moderate range, though no EPSS data is available. It is not catalogued in the CISA KEV list. Exploitation requires an unauthenticated attacker to target the Feishu webhook endpoint with crafted slow POST requests, consuming server resources and blocking legitimate traffic. The attack path is straightforward: send oversized or slow payloads before signature verification, causing resource exhaustion. Given that attack requires only HTTP access to the webhook endpoint, the threat surface is broad if the endpoint is publicly reachable.